Breach Reporting to Covered Entity Policy

Breach Reporting to Covered Entity Policy

Template. Replace every [bracketed] item with your organization's specifics. This Policy is for a Business Associate: how it reports breaches of unsecured PHI to the covered entity so the covered entity can meet its own notification duties. Have it reviewed by counsel before adoption.

Purpose

This Policy establishes how [Organization], as a Business Associate, detects and reports breaches of unsecured PHI to the affected covered entity, without unreasonable delay and within the required timeframe, with the information the covered entity needs to notify individuals, HHS, and the media. It satisfies 45 CFR § 164.410 and the reporting obligations of § 164.502(e).

Scope

This Policy applies to all workforce members and systems of [Organization] that create, receive, maintain, or transmit PHI under a Business Associate Agreement (BAA), and to any subcontractor that reports to [Organization].

Policy

1. Discovery triggers the clock (164.410(a))

A breach is treated as discovered on the first day [Organization], or any workforce member other than the person who committed it, knows or reasonably should know of it. Discovery starts the reporting clock and is logged immediately in the [incident log].

2. Notify the covered entity without unreasonable delay (164.410(b))

[Organization] notifies the affected covered entity without unreasonable delay and no later than 60 calendar days after discovery, or sooner where the BAA requires (many BAAs specify [10 days] or less; the stricter term controls). The [Privacy Official] owns and sends the notice.

3. Provide the required content (164.410(c))

To the extent known and as it becomes available, the notice identifies each individual whose unsecured PHI was (or is reasonably believed to have been) involved, and provides the information the covered entity needs for its own notifications: what happened, the types of PHI involved, the dates, and the steps [Organization] is taking to investigate, mitigate, and protect against further breaches.

4. Subcontractor reports flow up (164.502(e))

A breach discovered or reported by a subcontractor is treated as discovered by [Organization] per its BAA and is reported up to the covered entity on the same clock; [Organization] does not absorb or delay a subcontractor's report.

5. Document everything (164.410)

[Organization] retains the incident record, the breach risk assessment, the notice sent, and proof of timing for at least [six years], so it can demonstrate that reports were made correctly and on time.

HIPAA controls addressed

Review & version

Reviewed at least annually by the [Privacy Official] and after any breach or change to [Organization]'s BAAs. v1.0.