Section § 164.412Law enforcement delay

What it says

If a law enforcement official states to a covered entity or business associate that a notification, notice, or posting required under this subpart would impede a criminal investigation or cause damage to national security, a covered entity or business associate shall:

(a) If the statement is in writing and specifies the time for which a delay is required, delay such notification, notice, or posting for the time period specified by the official; or

(b) If the statement is made orally, document the statement, including the identity of the official making the statement, and delay the notification, notice, or posting temporarily and no longer than 30 days from the date of the oral statement, unless a written statement as described in paragraph (a) of this section is submitted during that time.

HIPAA, the United States rules protecting health information, § 164.412

What is in the packs for this

Each one helps with this requirement.

• DOCWord

  Business Associate Agreement Security Terms

  in HIPAA Security Rule ReadinessIts Framework References cite this section. Gives the security team the terms to check in a business associate agreement, each with its source and a pointer to the supplier clause library. It is not a legal template.
• DOCWord

  Breach Assessment & Notification Decision Procedure

  in HIPAA Security Rule ReadinessIts Framework References cite this section. Walks an incident through the breach presumption, the exclusions, secured information and the four-factor assessment, to a signed decision.
• DOCWord

  Incident Response Plan

  in Security Incident ManagementIts Framework References cite this section. Defines the response organisation, phases, decision authorities and hand-offs used for every incident regardless of type.
• DOCWord

  Personal Data Breach Response Playbook

  in Security Incident ManagementIts Framework References cite this section. Runs the security and privacy tracks of a personal data breach in parallel so the notification decision is made on facts.
• PPTPowerPoint

  Tabletop Scenario — Health Data Breach and the 60-Day Clock

  in Cyber Incident Exercises & Tabletop Scenario LibraryIts Framework References cite this section. Inject deck and facilitator notes testing the HIPAA breach assessment, discovery against declaration, the business associate chain and State-law notices on a 60-day clock.
• DOCWord

  Regulatory Notification Operating Procedure

  in Regulatory Incident Notification & ReportingIts Framework References cite this section. Assigns decision authority, drafting, legal review, submission and follow-up reporting for each regime.
• XLSExcel

  US Incident Notification Timeline Matrix (HIPAA, SEC, NYDFS and State Law)

  in Regulatory Incident Notification & ReportingIts Framework References cite this section. Sets out, for the US duties, who must be notified, by when, with what content and on what trigger under HIPAA, the SEC, New York's financial services rules, State law and the FTC.