Initial Notice to DHCS. Immediately upon discovery of a suspected security incident that involves data provided to DHCS by the SSA, the county shall notify DHCS by email or telephone. Within one working day of discovery, the county shall notify DHCS by email or telephone of unsecured PHI or PI, if that PHI or PI was, or is, reasonably believed to have been accessed or acquired by an unauthorized person, any suspected security incident, intrusion, or unauthorized access, use, or disclosure of Medi-Cal PII in violation of this Agreement, or potential loss of confidential data affecting this Agreement. Notice shall be made using the “DHCS Privacy Incident Report” (PIR) form, including all information known at the time. The County Department shall use the most current version of this form, which is posted on the DHCS Privacy Office website (xxx.xxxx.xx.xxx, select “Privacy & HIPAA” and then “County Use”) or use this link: xxxx://xxx.xxxx.xx.xxx/formsandpubs/laws/priv/Pages/CountiesOnly.aspx. Initial, Investigation, and Completed PIRs are submitted to the DHCS Privacy Office and the DHCS Information Security Office. A breach shall be treated as discovered by the County Department as of the first day on which the breach is known, or by exercising reasonable diligence would have been known, to any person (other than the person committing the breach), who is an employee, officer or other agent of the County Department. Notice shall be provided to the DHCS Privacy Office and the DHCS Information Security Office. Upon discovery of a breach, security incident, intrusion, or unauthorized access, use, or disclosure of Medi-Cal PII, the County Department shall take:
Initial Notice to DHCS. The County Department/Agency will provide initial notice to DHCS by email, or alternatively, by telephone if email is unavailable, of any suspected security incident, intrusion, or unauthorized access, use, or disclosure of PII or potential loss of PII with a copy to CDSS. The DHCS is acting on behalf of CDSS for purposes of receiving reports of privacy and information security incidents and breaches. The County Department/Agency agrees to perform the following incident reporting to DHCS:
Initial Notice to DHCS. The County Department/Agency shall notify DHCS using DHCS’ online incident reporting portal of any suspected security incident, intrusion, or unauthorized access, use, or disclosure of Medi-Cal PII or potential loss of Medi-Cal PII. When making notification, the following applies:
Initial Notice to DHCS. Immediately upon discovery of a suspected security incident that involves data provided to DHCS by the SSA, the countyThe County Department/Agency shall notify DHCS, by email, or alternatively, by telephone. Within one working day of discovery, the county shall notify DHCS by if email or telephone of unsecured PHI or PI, if that PHI or PI was, or is, reasonably believed to have been accessed or acquired by an unauthorized person, unavailable, of any suspected security incident, intrusion, or unauthorized access, use, or disclosure of Medi-Cal PII in violation of this Agreement, or potential loss of confidentialMedi-Cal PII. When making notification, the following applies:
Initial Notice to DHCS. The CalSAWS Consortium shall notify DHCS, by email, or alternatively, by telephone if email is unavailable, of any suspected security incident, intrusion, or unauthorized access, use, or disclosure of Medi-Cal PII or potential loss of Medi-Cal PII. When making notification, the following applies:
Initial Notice to DHCS. The County Department will provide initial notice to DHCS with a copy to CDSS. The DHCS is acting on behalf of CDSS, for purposes of receiving reports of privacy and information security incidents and breaches. The County Department agrees to perform the following incident reporting to DHCS. Immediately upon discovery of a suspected security incident that involves data provided to DHCS by the SSA, the County Department shall notify DHCS by email or telephone. Within one working day of discovery, the County Department shall notify DHCS by email or telephone of unsecured PII, if that PII was, or is, reasonably believed to have been accessed or acquired by an unauthorized person, any suspected security incident, intrusion, or unauthorized access, use, or disclosure of PII in violation of this Agreement, or potential loss of confidential data affecting this Agreement.
