Facility & Incident Information

This article provides guidance on completing the Facility Information and Incident Information sections required for the Data Breach Risk Assessment (DBRA) process, covering facility details, business associate involvement, incident details, and assessment initiation.

• Facility Information
• Incident Information

Facility Information 

Use the Facility Information section to enter details related to the affected facility, including location, address, privacy contacts, and disclosure impact information. This information helps support accurate breach assessment and reporting during the DBRA process.

In the Facility Information section, the user can enter the relevant details for the affected facility and the disclosure event.

Available fields may include:

1. Location - Select the applicable facility or organizational location. The user can also select multiple locations when needed.
2. Facility Name - Enter the name of the selected facility.
3. Facility Address - Enter the address associated with the facility.
4. Facility Privacy Officer - Type or review the assigned privacy officer for the facility.
5. Facility Security Officer - Type or review the assigned security officer for the facility.
6. Number of Individuals Potentially Affected by Disclosure - Enter the estimated number of affected individuals.

7. Business Associate Involvement - Indicates whether a business associate is involved in the disclosure event.

   📝 Notes

   • Fields marked with a red asterisk (*) are required.
   • If a Business Associate is involved in the disclosure event, refer to the Business Associate Involvement section and complete the related information.

   

   💡 Workflow Tips

   Enter complete facility information to support accurate breach documentation and reporting.

Business Associate Involvement

Select Is a Business Associate involved?, checkbox if the disclosure event involves a business associate. When selected, the Business Associate Information section is enabled, allowing users to enter related business associate details.

Available fields may include:

1. Name of Business Associate - Enter the name of the involved business associate.
2. Business Associate Address - Enter the business associate address information. 
3. Contact Name/Title - Enter the primary contact name and title.
4. Phone Number - Enter the contact phone number.
5. Email - Enter the business associate contact email address.

6. Subcontractor/Third Party Involvement - Indicates whether a subcontractor or third party is involved in the disclosure event.

   

   📝 Notes

   • If a Subcontractor/Third Party is involved in the disclosure event, refer to the Subcontractor/Third Party Involvement section and complete the related information.

Subcontractor/Third Party Involvement

Select the Is a Subcontractor/Third Party involved?, checkbox if a subcontractor or third party is associated with the disclosure event. When selected, the Subcontractor/Third Party field is enabled.

Available field:

1. Subcontractor/Third Party - Enter the name of the involved subcontractor or third-party organization.

   

Incident Information

Use the Incident Information section to document key breach event details, including incident dates, applicable state requirements, and related incident records.

Follow these steps to add Incident Information:

1. Enter the Incident Date for when the disclosure or breach occurred.
2. Enter the Report Date for when the incident was reported or identified.

3. Select the applicable State associated with the incident.

   📝 Notes

   If the desired state is not available in the State list, contact your administrator to configure the required state settings.
4. In the Attach or Create Incident field:
   • Search for and attach an existing incident record, or

   • Select Report New Incident to create a new incident record.

     📄 Learn More

     To report a new incident, refer to the Report an Incident article and follow the provided instructions.

5. Click Start Assessment to process further. The Exception Analysis page is displayed.

   

6. After completing the Facility and Incident Information process, refer to the DBRA Exception Analysis article for details about continuing the assessment workflow.

© Healthicity, LLC