Far Northern Regional Center

Potential Privacy and Security Incident Report Form

Entity Name:

Entity Contracted with: DDS; Developmental Center/Community Facility; Regional Center;

Initial Incident Report

Addendum to previous report

Incident Start Date: or Unknown

Incident End Date:

Incident Discovery Start Date: or Unknown

Incident Discovery End Date:

Location of Incident:

Number of Individuals affected:

500 or more individuals

Fewer than 500 individuals affected by the breach.

Type of Breach: Location of Breach: Encrypted

Hacking/IT Incident Desktop Computer Yes No

Improper Disposal Electronic Medical Record Yes No

Loss E-Mail Yes No

Theft Laptop Yes No

Unauthorized Access/Disclosure Network Server Yes No

Other Potable Electronic Device Yes No



Was personally identifiable information involved? Yes No

Health or Medical or Clinical Information Demographic

Lab Results Name

Medications Address/Zip

Other Treatment Information Date of Birth

Driver’s License/State ID Number

Social Security Number

Financial Account Number Other (Specify)

Claims Information

Credit Card/Bank Account Number

Other Financial Information

Are notifications required? Yes; Notification Date:


Costs Associated with the Breach: Less than $1000.00

Greater than $1000.00

Far Northern Regional Center

Potential Privacy and Security Incident Report Form

Breach Description

Safeguards in place (prior to the breach incident):


Privacy Rule Safeguards (Training, Policies and Procedures, etc.)

Breach; Security Rule Administrative Safeguards (Risk Analysis; Risk Management, etc.)

Security Rule Physical Safeguards (Access Controls; Workstation Security, etc.)

Security Rule Technical Safeguards (Access Controls; Transmission Security, etc.)

Corrective Actions

Adopted encryption technologies

Changed password/strengthened password requirements

Create a new/updated Security Rule Risk Management Plan

Implemented new technical safeguards

Implemented periodic technical and nontechnical evaluations

Improved physical security

Performed a new/updated Security Rule Risk Analysis

Provided business associated with additional training on HIPAA requirements

Provided individuals with free credit monitoring

Revised business associate contracts

Revised policies and procedures

Sanctioned workforce members involved (including termination)

Took steps to mitigate harm

Trained or retrained workforce members




Printed Name of Information Signature of Information Date

Security Officer Security Officer


Printed Name of Privacy Officer Signature of Privacy Officer Date


Printed Name of Director or Designee Signature of Director or Designee Date

Please complete this form with as much information as possible submit to .

Forms/Administrative/262.mrg.doc (07/11/17) Page 1 of 2