1011 Data Breach Reporting

Georgia State Seal

Georgia Division of Aging Services
Administrative Manual

Chapter:

1000 General DAS Administration

Effective Date:

04/10/2023

Section Title:

Data Breach Reporting

Reviewed or Updated in:

MT 2023-06

Section Number:

1011

Previous Update:

MT 2021-04

Policy Statement

All information gathered from clients in the application for and delivery of all services of the Division of Aging Services must be protected under various state and federal laws. In compliance with all applicable state and federal rules, it is the policy of the Georgia Department of Human Services Division of Aging Services (DHS/DAS) that all data breaches must be reported as detailed in this policy.

Policy Basics

Legal Authority:

  1. Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended and including the Health Information Technology for Economic and Clinical Health Act of 2009 (HITECH) at 45 C.F.R. Parts 160 and 164.

  2. Older Americans Act – confidentiality rules at 45 C.F.R. §1321.51

  3. Georgia Personal Identity Protection Act (GPIPA) at O.G.C. §10-1-910 et seq

  4. The Privacy Act of 1974 at 5 U.S.C. §552a

  5. Adult Protective Services confidentiality rules at O.C.G.A §30-5-7.

Basic Considerations

Applicability

This policy applies to all DHS staff, contractors, subcontractors, volunteers, and vendors of services. Anyone who gathers, enters, sees, accesses, transports, or stores sensitive data with or on behalf of the Department is subject to this policy.

Definitions

Access: the ability or the means necessary to read, view, record, modify, or communicate program data or information or to otherwise use any program system resource.

Breach or Potential Breach: an unauthorized and/or impermissible acquisition, access, use, or disclosure of protected health information or personally identifiable information which compromises the security or privacy of such information or fact that lead one to believe preliminarily that such an event may likely have occurred.
DHS Management: the DHS Commissioner or her designee.

DHS Privacy Officer: a position officially appointed by the DHS Commissioner to serve as the agency focal point for all HIPAA privacy matters.

Personally Identifiable Information (PII): any information about an individual, maintained by DHS, including:

  1. Any information that can be used to distinguish or trace an individual’s identity, such as name, social security number, date and place of birth, mother’s maiden name, or biometric records

  2. Any other information that is linked or is linkable to an individual, such as medical, educational, financial, or employment information

Protected Health Information (PHI): information that is created or received by a health care provider, health plan, employer, or health care clearinghouse that identifies an individual or provides a reasonable basis to believe the information can be used to identify the individual and that relates to:

  1. The past, present, or future physical or mental health condition of an individual

  2. The provision of health care to an individual, or

  3. The past, present, or future payment for the provision of health care to an individual

Responsibilities

All employees, contractors, and subcontractors are required to comply with all confidentiality and information safety requirements including the following:

  1. To understand and comply with the organization’s policies, procedures, and/or contractual obligations regarding confidentiality, privacy, and security of all DHS data

  2. To report any suspected breach, intentional or unintentional, of personal identifying information or protected health information

  3. Comply with all information safety training requirements.

Procedures

The following procedures must be followed when a breach or potential breach has occurred:

Reporting

All potential data breaches are to be immediately reported to the DHS Privacy Officer as soon as a breach or potential breach is suspected or discovered. If the DHS Privacy Officer is not available, then the breach should be reported to the General Counsel, Deputy General Counsel, or Division Associate General Counsel.

The initial report to DHS is to be made on or to include the “Data Breach Security Incident Reporting Form” which is on the Office of General Counsel page on the DHS website. Depending on the urgency of the circumstances, alternative means of reporting the breach are acceptable at first but should be followed up with a written report within two (2) business days of discovering the breach.

Following the initial report of the incident, a more complete report regarding the incident will be required in order for a risk analysis to be conducted.

Investigation

The DHS Privacy Officer will instruct the relevant program to perform, and will assist in performing, a risk analysis assessing the following factors to determine whether the PHI or PII has been compromised:

  1. The nature and extent of the PHI or PII involved, including the types of identifiers and the likelihood of re-identification;

  2. The unauthorized person who used the PHI or PII or to whom the disclosure was made;

  3. Whether PHI or PII was actually acquired or viewed; and

  4. The extent to which the risk to the PHI or PII was mitigated.

The results of the incident investigation will determine the actions to be taken.

Depending on the analysis by the DHS Privacy Officer or a representative substitute, a determination will be made as to:

  1. If the event meets the criteria of a breach and, if applicable,

  2. The type of breach and the subsequent regulatory reporting protocols that must be followed, I.E. HIPAA, Privacy Act, Social Security, etc.

Response

Once it is determined that a breach either has occurred or it can be reasonably expected that a breach may have occurred or is occurring, the Privacy Officer will determine the need to alert the Data Breach Task Force (DBTF).

Upon review of the incident and regardless of whether or not PHI or PII is breached, the DHS Privacy Officer or the DBTF shall develop and implement a plan to accomplish the following:

  1. Ensure that the conditions that made the incident possible are corrected so as to prevent future incidents. This may include recommendations for further training of employees, requirements for contractors to do more training, or changes to office technology, training, policy, or procedures.

  2. Identify individuals whose PHI or PII was or may have been disclosed, and the persons or entities to whom PHI or PII was or may have been disclosed.

  3. Mitigate any possible harm that may have resulted from the incident.

Notification

Upon determination and immediate mitigation steps of the breach, the DHS Privacy Officer or the DBTF will take necessary steps to adhere to all noticing requirements for the individuals' whose information was compromised and comply with all noticing requirements, or applicable, regulatory agencies, as required by statute, rule, or regulation. The DHS Privacy Officer or the DBTF will follow the appropriate DHS procedures consistent with the type of data or information that has been disclosed including, but not limited to, any of the following or any combination of the following:

  1. HIPAA Data Breach Protocol

  2. Privacy Act Data Breach Protocol

  3. Social Security Act Data Breach Protocol

  4. Georgia Personal Identity Protection Act (GPIPA) Protocol

  5. Any other contractual Data Breach Requirements (e.g. Accruing, etc.)

The DBTF will also provide guidance on how to prevent additional breaches from occurring in the future and any remedial efforts that are recommended.

Documentation

DHS, through its Privacy Officer, will keep a record of each reported breach in compliance with applicable regulations or requirements. If no time is prescribed for records retention, then for a reasonable period not to exceed five (5) years from when the breach is discovered.

The DHS Privacy Officer will report on behalf of DHS to applicable regulatory or federal agencies as required by the specific regulations.

Administrative Requirements

Training

DHS shall train all members of the DHS workforce with respect to breach reporting obligations and procedures annually, so employees are able to identify suspected breaches of protected health information and personally identifiable information and know how to immediately report all such events to the DHS Privacy Officer. Evidence of employees receiving this annual training shall be documented and maintained.

  1. New staff member training: New staff members will be trained on data security awareness and HIPAA (Privacy and Security) within a reasonable time period after their hire date with the department.

  2. Recurrent training: Staff members are to be trained on Privacy and Security as a refresher within a reasonable time and no less than annually. Please refer to the Privacy and Security Training Protocol for guidance on the most current training and frequency of training.

  3. Special function training: Staff members are to be trained on Privacy and Security Training within three months after substantive changes are made to this policy or as necessary.

Sanctions

DHS expects that all employees, contractors, and subcontractors will comply with all laws, regulations, standards, policies, procedures, guidelines, and expectations regarding the privacy and security of DHS protected health information and personally identifiable information. Applicable consequences on non-compliance with this policy may include reprimand, suspension, removal, or other actions in accordance with applicable law and DHS policy. In cases of egregious disregard or a pattern of error in safe-guarding information, the minimum consequence DHS may consider is prompt removal of or modification of authority to access information. Willful breach of HIPAA or other confidentiality laws may be turned over to appropriate law enforcement, prosecutors, or auditors.

Additional Information

For DHS staff, please contact your Associate General Counsel or the DHS Privacy Officer for more information.

For DHS contractors, please see your contract and Business Associate Agreement for more details. For most questions, you will have to consult your own legal counsel.

References

Health Insurance Portability and Accountability Act; 45 C.F.R., Parts 160 & 164

Older Americans Act; 45 C.F.R. §1321.51

Georgia Personal Identity Protection Act; O.C.G.A. §10-1-910

Privacy Act of 1974; 5 U.S.C. §552a

Georgia Protection of Disabled Adults and Elder Persons; O.C.G.A. §30-5-7

OCG Data Breach Response Policy; ODIS POL 1660

OCG Data Breach Incident Report Form; ODIS POL 1660 Attachment A

DAS Admin Technology and Data Management; ODIS MAN 5600, Section 1060

DAS Admin Confidentiality; ODIS MAN 5600, Section 2053

DAS Admin HIPAA; ODIS MAN 5600, Section 2054