4 hours High Priority: Operations Review Current Analyst, Inadvertent Incomplete Policies and Disclosure Policies & 2 hours HR, Procedures; identify of PHI <500 Investigation Procedures priorities and make records by HHS 4 hours IT recommendation next Analyst meeting on timing and resource 2 hours requirements Facility 40 hours IT analyst, Notification to Insufficient Theft of PHI Individuals High Priority 40 hours HR, Access <500 Reputational Controls records) 10 hours cost Various supervisors Loss/Theft Cost of Breach Unencrypted of Laptop encryption Notification High Priority Laptops >500 Costs 120 hours IT records Exhibit C Recommendation: Decision-Making for Policy Approval and Procedure Review Decision Rights for Privacy Policies Electronic Administrative Uses & Individual Rights Policies Policies Disclosures
Incomplete Policies & Procedures Inadvertent Disclosure of PHI <500 records Investigation by HHS High Priority: Review Current Policies and Procedures; identify priorities and make recommendation next meeting on timing and resource requirements 4 hours Operations Analyst, 2 hours HR, 4 hours IT Analyst 2 hours Facility Insufficient Access Controls Theft of PHI <500 records) Notification to Individuals Reputational cost High Priority 40 hours IT analyst, 40 hours HR, 10 hours Various supervisors Unencrypted Laptops Loss/Theft of Laptop >500 records Breach Notification Costs High Priority Cost of encryption 120 hours IT Exhibit C Recommendation: Decision-Making for Policy Approval and Procedure Review Decision Rights for Privacy Policies Electronic Policies Administrative Policies Uses & Disclosures Individual Rights