ATTM 016 INCIDENT REPORT.pdf
PDF 225 KB Posted
- Attached to
- MEDICAID ELIGIBILITY OPERATIONS SERVICES
- Solicitation number
- 5400021745
- Issued by
- Richland County, South Carolina
About this file
This is an Incident Report Form for Business Associates issued by the South Carolina Department of Health and Human Services (SCDHHS) for reporting unauthorized use, disclosure, security incidents, breaches, and potential breaches of Personally Identifiable Information (PII) and Protected Health Information (PHI). The form requires business associates to report incidents to privacyoffice@scdhhs.gov and provides a comprehensive framework for documenting incident details including date of discovery, description, scope, and resources involved. Business associates must specify the type of incident (unauthorized access, hacking, malware, improper disposal, theft, loss, or unknown causes), identify whether SCDHHS equipment or networks are involved, and document all PII/PHI affected, including the approximate number of individuals impacted. The form requests detailed information about existing safeguards such as privacy training, security rule compliance, physical facility controls, technical safeguards, firewalls, and authentication measures.
The form requires business associates to document breach determinations, mitigation actions taken, corrective action plans, and any sanctions or training provided in response to the incident. Business associates must also confirm whether HIPAA breach notification requirements have been met and attach supporting documentation including breach notifications to the HHS Secretary and notification letters to affected individuals. The form emphasizes that initial reporting need not include all information, with updates submitted as the investigation progresses. This incident reporting protocol applies to all business associates contracting with SCDHHS for Medicaid Eligibility Operations Services and establishes mandatory reporting and documentation procedures for maintaining compliance with HIPAA privacy and security requirements.
View the file
Other files
Show all 23
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
INCIDENT REPORTING FOR BUSINESS ASSOCIATES
Any unauthorized use, unauthorized disclosure, security incident, breach or potential breach is reported on this form, and referred to in this form for simplicity as an “incident.”
Report the information on the incident to privacyoffice@scdhhs.gov. You may not have the information necessary to complete this form upon initial reporting. As information becomes available during the investigation, update the form, and resubmit to privacyoffice@scdhhs.gov.
BUSINESS ASSOCIATE
Entity name (Company, Agency, University, etc.):
BUSINESS ASSOCIATE POINT OF CONTACT
Name:
Address:
Telephone:
Email:
DATE OF DISCOVERY OF INCIDENT
DESCRIPTION OF THE INCIDENT
Describe the incident. Include date(s) related to the discovery of the incident, location(s) related to the incident, hardware/software involved, how discovered, etc.
Was PII/PHI improperly shared with or disclosed to an unauthorized individual or entity?
Yes No
If yes, provide details.
Was the PII/PHI encrypted?
SCOPE OF THE INCIDENT
List the resources involved. Include hardware, software, data1., etc.
What Personally Identifiable Information (PII) or Protected Health Information (PHI) was involved?
Provide the approximate number of individuals affected.
COMPUTER2 INCIDENT
Type of incident: Unauthorized access or disclosure ☐ Hacking, Malware/Virus ☐
1 List individual data elements as well as data groups or classes; for example: Name, address, information on family members, date of birth, Social Security Number, income information, Federal Benefits, child support, financial information, rent, mortgage payments, and wage information.
2 Computer means computer, laptop, smartphone, tablet assigned to individual for performance of work. Incident may involve more than one computer. Respond as necessary to answer questions for all computers involved.
Improper disposal/not sanitized ☐ Theft ☐ Loss ☐ Unknown ☐
Worm ☐ Trojan ☐ Buffer Overflow ☐ Denial of Service (DOS) ☐ Other
Specify
Could the incident involve SCDHHS equipment, network or servers?
If yes, provide details.
SAFEGUARDS IN PLACE
What safeguards are in place to prevent such incidents? Check all that apply.
☐ None
☐ Privacy Rule (training, policies, and procedures, etc.)
☐ Security Rule Administrative Safeguards (risk analysis, risk management, etc.)
☐ Security Rule Physical Safeguards (facility access controls, workstation security, etc.)
☐ Security Rule Technical Safeguards (role-based access controls, transmission security, etc.)
☐ Firewalls
☐ Secure Browser Sessions
☐ Strong Authentication
☐ Logical Access Control
☐ Intrusion Detection
Please provide additional information regarding safeguards.
MITIGATION ACTIONS TAKEN
Describe actions taken in response to the incident.
BREACH DETERMINATION AND REPORTING
Is the incident a breach?
Yes No
How did the Business Associate reach this determination? (For example, did Business Associate perform a risk assessment?)
Have HIPAA breach notification requirements been met3?
CORRECTIVE ACTION PLAN
What actions were taken to ensure that the incident does not recur?
SANCTIONS
Describe any sanctions taken against user or others.
3Attach a copy of the breach notification to HHS Secretary and notification letter to individuals.
TRAINING
Describe any corrective training provided to user or others.
OTHER
Provide any information that you believe is important to this incident or breach review. Attach any supporting documents to your email when you submit to the Privacy Official.
All privacy and security incidents and/or breaches should be submitted to privacyoffice@scdhhs.gov.
mailto:privacyoffice@scdhhs.gov
| business Associate |
| Business Associate Point of Contact |
| Date of discovery of Incident |
| Description of the Incident |
| Scope of the Incident |
| Computer1F Incident |
| Safeguards in place |
| Mitigation Actions Taken |
| Breach Determination and Reporting |
| Corrective Action Plan |
| Sanctions |
| Training |
| Other |
File details come from the government source that posted it. Updated .