Data Breach Notification Policy at Transformation Healthcare INC

A data breach is defined as the authorized acquisition, access, use, or disclosure of PHI.

PHI stands for Personal Health Information.

The Breach Notification Rule under HIPAA does not require covered entities to notify affected individuals following a breach of unsecured PHI.

If a data breach involves more than 500 individuals in the same state or jurisdiction, the Company is required to provide media notification within 30 days.

Annual training on data breach notification policies and procedures is not required for employees, contractors, and business associates who handle PHI.

Non-compliance with the data breach notification policy may result in disciplinary action, but termination of employment or contract is not a possible consequence.

Data breaches only include the disclosure of financial information that compromises the security of individuals.

The Company is not required to document all reported potential data breaches and related investigations.

The Breach Notification Rule requires covered entities to notify affected individuals and the Secretary of Health and Human Services only if the breach involves secured PHI.