List what was exposed before deciding any breach notice
Key facts
- Human involvement
- YellowClose supervision
- How AI is used
- List the kind of information, the number of people if the file states it, and the date the file gives for discovery. Do not say a notice is required and do not draft one.
- What the lawyer must review
- You decide whether any notice statute applies. No state data-breach statute was opened. The HHS breach page applies to a breach of unsecured protected health information by a covered entity or its business associate. Individual notice is without unreasonable delay and in no case later than 60 days following discovery. Media notice is required when more than 500 residents of a State or jurisdiction are affected. A business associate notifies the covered entity. The page describes exceptions and a risk assessment. You read those before you use the 60 days. An ordinary client file is not that breach unless you decide the information is unsecured protected health information held by a covered entity or business associate. 45 CFR § 164.502(a) is the use-and-disclosure limit for that information. Formal Opinion 512 applies before the file goes into a tool.
- Written for / version
- United States versionUS
Who does what
| Role | What they do |
|---|---|
| Assistance | Potential support includes preparing preliminary structure or wording. Confirm the tool’s capability and permitted scope. |
| Lawyer | Set the scope, supervise the work closely, verify every part relied on, resolve omissions and exceptions, and approve the exact output. |
Checklist
- Verify the applicable jurisdiction and the version of each relevant law, rule or instrument in force at the material time.
- Confirm the output against the client’s instructions and the complete relevant source material, including omissions or contradictions.
- Resolve exceptions and record the responsible lawyer’s approval of the exact output and intended use.