HIPAA - Sample Notification Letter to Secretary of Health & Human Services

Secretary of Health & Human Services

The U.S. Department of Health and Human Services

200 Independence Avenue, S.W.

Washington, D.C. 20201

Telephone: 202-619-0257

Toll Free: 1-877-696-6775

Dear Secretary:

In compliance with the American Recovery and Reinvestment Act of 2009 (ARRA)/Health Information Technology for Economic and Clinical Health Act (HITECH), we are notifying you of a recent breach of unsecured protected health information (PHI).  The breach involved ________________ patients. We became aware of this breach on _______________ which occurred on or about _________ .  The breach occurred as follows:

(Describe event and include the following information as communicated to the victims)

1.  A brief description of what happened, including the date of the breach and the date of the discovery of the breach, if known.

2.  A description of the types of unsecured protected health information that were involved in the breach (such as whether full name, Social Security number, date of birth, home address, account number, diagnosis, disability code or other types of information were involved).

3.  Any steps the individual should take to protect themselves from potential harm resulting from the breach.

4.  A brief description of what the organization is doing to investigate the breach, to mitigate harm to individuals, and to protect against further breaches.

5.  Contact procedures for individuals to ask questions or learn additional information, which includes a toll-free telephone number, an e-mail address, Web site, or postal address.

On behalf _____________________________ I am communicating this information to you in compliance with HIPAA and The HITECH Act.

If you have any questions or require further information, please contact me at ______________.

Sincerely,

___________________________