• Security Management Process

• Conduct a comprehensive, organizational-wide risk analysis of the ePHI security risks and vulnerabilities, including review of electronic media and systems.

• Develop a risk management plan to address and mitigate any security risks and vulnerabilities following the risk analysis and, if necessary, revise its present policies and procedures.
  

• Provide to OCR for review and approval the risk analysis, risk management plan and any revised policies and procedures and implement any revisions suggested by OCR.

• Implement, distribute, and train all appropriate staff members on the revised policies and procedures within 30 days.

• Track and Report to OCR Any Further Breaches

• APDerm must, "upon receiving information that a workforce member may have failed to comply with any provision of its Privacy, Security, and Breach Notification policies and procedures, promptly investigate the matter."

• If, after the investigation, APDerm "determines that a member of its workforce has failed to comply with a provision of its Privacy, Security, and Breach Notification policies and procedures, the Covered Entity shall notify OCR in writing within thirty (30) days."
  

• The report to OCR must include:

• "A complete description of the event, including relevant facts, the persons involved, and the implicated provision(s) of the Covered Entity’s Privacy, Security, and Breach Notification policies and procedures; and" [5]
  

• "A description of actions taken and any further steps the Covered Entity plans to take to address the matter, to mitigate the harm, and to prevent it from recurring, including the application of appropriate sanctions against workforce members who failed to comply with its Privacy, Security, and Breach Notification policies and procedures." [6]

• Provide to OCR an Implementation Report, which is to include, among other things,
  

• "An explanation of how the Covered Entity implemented its security management process ... focusing specifically on how The Covered Entity determined whether its policies and procedures should be revised based on the risks and vulnerabilities identified in the risk analysis." [7]
  

• An attestation from an APDerm officer that any revisions to policies and procedures were fully implemented and distributed to all workforce members.

• "An attestation signed by an officer of the Covered Entity stating that he or she has reviewed the Implementation Report, has made a reasonable inquiry regarding its content and believes that, upon such inquiry, the information is accurate and truthful."
  [8]

Entities subject to HIPAA compliance should take note of the requirements in the Corrective Action Plan, particularly the list of details that a report to OCR should include. The details noted by OCR should be included in the entity's breach investigation and report checklist. Specifically, any HIPAA breach investigation checklist should include, at least, the following elements:

1. Description of the event
2. Person(s) involved in the event
3. Policies and procedures that were impacted by the event
• Privacy policies
• Security policies
• Breach notification policies
4. Steps covered entity took to mitigate any perceived harm
5. Steps covered entity will take to address the specific incident
• Workforce member sanctions
• Additional training requirements for all workforce members
6. Steps covered entity will take to prevent the harm in the future