Home Health & Hospice Week

Keep in mind your HHS reporting duties.

Question: What must we do in terms of breach notification if we mail a statement to the wrong patient? The statement doesn’t have much information on it, just visit dates. Would we have to go through the whole breach notification process?

Answer: "This is a typical situation," says HIPAA expert Jim Sheldon-Dean of Lewis Creek Systems in Charlotte, Vt. "The kind of breach that happens most often is a piece of paper that winds up in the wrong envelope and goes to the wrong address."

And the statement doesn’t even necessarily need to have very much information on it, "but if it does have somebody’s name and something about [a] visit in any way, then that really is the kind of information you need to report as a breach," Sheldon-Dean says.

But this is a relatively straightforward process because the breach involves just one individual’s information. You have to notify only that one individual, but you do need to send the patient the official notification, Sheldon-Dean stresses. And the breach will be one that you should submit in your annual accounting to the Department of Health and Human Services before 60 days after the end of each year.