united-states medical hipaa
Are healthcare service employees required to notify anybody (in general or particular) of a HIPAA violation?
<p>I was notified by one of our patients that they received a "Summary of Today's Visit" in the mail, however, it wasn't their own "Summary of Today's Visit", it was that of another patient.</p>

<p>Knowing that this is a HIPAA violation, am I required to notify the patient whom's information was sent to the wrong person?</p>

<p><a href="https://www.ecfr.gov/cgi-bin/text-idx?SID=0ed84c7423abdfca1fa81d772667435a&amp;mc=true&amp;node=sp45.1.164.d&amp;rgn=div6" rel="nofollow noreferrer">The requirements</a> are imposed on <a href="https://www.ecfr.gov/cgi-bin/text-idx?SID=f175743556763460c01fca8b037a078f&amp;mc=true&amp;node=se45.2.160_1103&amp;rgn=div8" rel="nofollow noreferrer">"the covered entity"</a>. You personally may not be required to do anything, apart from whatever your employer requires of you, but §164.404(a) says:</p>

<blockquote>
  <p>A covered entity shall, following the discovery of a breach of
  unsecured protected health information, notify each individual whose
  unsecured protected health information has been, or is reasonably
  believed by the covered entity to have been, accessed, acquired, used,
  or disclosed as a result of such breach.</p>
</blockquote>

<p>What you describe is a breach. That section provides other information about timing and content of notification.</p>
