Purpose

LifeCare is committed to protecting patient information. All workforce members are responsible for promptly reporting any actual or suspected privacy or security incident involving Protected Health Information (PHI).

Policy

All Employees and Independent Contractors must immediately report any actual, suspected, or potential breach of patient information. When in doubt, report it.

Report Immediately

Notify the LifeCare Medicare Compliance Officer of any and all suspected violations, including, but not limited to:

 

• Lost or stolen phones, tablets, laptops, or other devices used for LifeCare business

• Lost or misplaced patient records

• Email, text, fax, or mail sent to the wrong person

• Unauthorized access to patient information

• Discussions of PHI that may have been overheard

• Suspected malware, phishing emails, or security threats

• Accidental disclosure of patient information

• Use of an unsecured Wi-Fi network while accessing PHI

• Any situation where patient information may have been viewed, accessed, or disclosed by an unauthorized person

What to Do

• Stop further disclosure of information if possible.

• Secure the device, record, or information.

• Report the incident immediately.

• Cooperate with any follow-up investigation.

Do not attempt to investigate or resolve the issue on your own.

Failure to Report

Failure to timely report a known or suspected privacy or security incident may result in disciplinary action up to and including termination of employment or contract.