HHSA Complaint Privacy Form

REPORT DETAILS

REPORTING PARTY INFORMATION

First and Last Name

*

Title

*

PRIMARY STAFF INVOLVED IN PRIVACY INCIDENT

INDIVIDUAL STAFF INFORMATION

First Name

Last Name

Primary job function/duties

Other HHSA Region/Department

Aid Program(s) involved in incident

Reason privacy training not completed timely

If not trained in Privacy in the last 12 months, date of most recent Confidentiality Statement signed

Employee location/worksite address

List names of any other staff members involved in privacy incident

Separate each staff with a comma

Privacy Incident Details

Describe Incident

*

What was the primary job function of the person who viewed or (accidently) obtained PHI/PI?

Additional basic information regarding incident

Location of Privacy Incident

Date(s) or date range of Privacy Incident

(If entering multiple dates, please comma-separate each date)

Incident Discovery Date

*

If Yes, please explain

If incident report is more than 1 day after incident, explain reason for delay

If Yes, please explain

Describe Corrective Action and/or Disciplinary Action Taken

Date written notification letter sent to client(s):

If written notification letter not sent, explain rationale

Describe data security measures and mitigating factors

INCIDENTS INVOLVING LOSS OR THEFT OF ASSETS (i.e. computer, mobile device, access badge, keys)

Laptop/Tablet Asset/Inventory #

Mobile device phone #

Date request submitted to IT for device wipe (YYYY/MM/DD)

If device wipe delayed more than 1 day or not submitted, explain

IT Ticket Tracking # for device wipe

Date device wipe completed/confirmed by IT (MM/DD/YY)

County Only: Date CSRF submitted to remove mobile device from AirWatch MDM (YYYY/MM/DD)

If incident involves access badge or keys, date request submitted to disable badge/change locks (YYYY/MM/DD)

Date badge deactivated / locks changed (MM/DD/YY)

DATA INVOLVED IN INCIDENT

Number of individuals affected by Privacy Incident

Number of adults on Medi-Cal

Number of minors under 18 yrs. affected by Privacy Incident?

Number of minors on Medi-Cal

Describe 'Other' type of protected information (including: county/contractor case #, open/close date, court or police report, appointment info, EBT card#, telephone/mobile/fax #, Web URL or IP address, photo/video image, biometric fingerprint or voice print)

Describe 'Other' type of financial information

Describe 'Other' type of clinical information (including: physical health or medical health, HIV/AIDS test results, Appt information, Health plan name (including Medi-Cal), health insurance claim information, case status)

If 'Other', describe (including: other type of cell phone, appointment book, verbal, tablet, medication bottle, label, fax, text, BIC/EBT card, computer system (provide system/application name), network server name and who owns it)

ADDITIONAL INFORMATION REGARDING SAFEGUARDS

Describe 'Other' type of Malicious Code or Malware type

DATA AND RECOVERY

If data was recovered, specify what, when, and who has it now

If not recovered, explain

If 'Pending', describe steps taken to recover data

If Incident involves e‐mail or fax, enter date confirmation received that all communication, including attachments permanently deleted/destroyed by recipient (YYYY/MM/DD)

Discuss impact of Privacy Incident (risk, potential misuse of data, identity theft, etc.)

Describe mitigation plan and status (if necessary attach separately)

Describe 'Other' type of security incident

WITNESS INFORMATION

Witness Address

HHSA Privacy Incident Report (PIR)