Breaches of PII and PHI

Guidelines for Reporting Breaches

This document outlines the DoD reporting and notification requirements for breaches.

DoD Instruction 8580.02: Security of Individually Identifiable Health Information in DoD Health Care Programs

This instruction establishes policy and assigns responsibilities for security of individually identifiable health information created, received, maintained, or transmitted in electronic form (referred to in this instruction as “electronic protected health information (ePHI)”).

• Identification #: DoD Instruction 8580.02
• Date: 8/12/2015
• Type: Instructions
• Topics: HIPAA Compliance within the MHS | Breaches of PII and PHI | Submit a Data Sharing Application

DoD Instruction 8580.02: Security of Individually Identifiable Health Information in DoD Health Care Programs

This instruction establishes policy and assigns responsibilities for security of individually identifiable health information created, received, maintained, or transmitted in electronic form (referred to in this instruction as “electronic protected health information (ePHI)”).

• Identification #: DoD Instruction 8580.02
• Date: 8/12/2015
• Type: Instructions
• Topics: Privacy and Civil Liberties | Breaches of PII and PHI

United States-Computer Emergency Readiness Team (US-CERT) Reporting Instructional Guidance

This document provides instructions for breach reporting to the United States-Computer Emergency Readiness Team (US-CERT).

DoD Directive 5400.11: Department of Defense Privacy Program

This Regulation is reissued under the authority of DoD Directive 5400.11, “DoD Privacy Program,” May 8, 2007. It provides guidance on section 552a of title 5 United States Code (U.S.C.), the Privacy Act of 1974, as amended, and prescribes uniform procedures for implementation of the DoD Privacy Program.

• Identification #: DoD Directive 5400.11-R
• Date: 10/29/2014
• Type: Directives
• Topics: Submit a Data Sharing Application | Privacy Act at DHA | Freedom of Information Act | Privacy Impact Assessments | Breaches of PII and PHI | How HIPAA Protects You | HIPAA Compliance within the MHS

Plan of Action and Milestone Template

This template is used to track plans of action and milestones regarding potential breaches.

Malicious Code Overview

An Information Paper that explains what malicious code is, including the various types, the proper response to a malicious code attack, and steps to take to avoid receiving malicious code on a computer system.

Phishing Overview

An Information Paper that tells what phishing is, how to respond to phishing attacks, and steps to take to avoid becoming a victim of phishing scams.

Social Networking Overview

An Information Paper that defines social networking, details the Department of Defense's position on this topic, and discusses the responsible use of social networking and Internet-based capabilities.

Examples of PII

Personally identifiable information (PII) is information that identifies, links, relates, or is unique to, or describes you. This also includes information which can be used to distinguish or trace your identity and any other personal information which is linked or linkable to you.

DD Form 2959: Breach of Personally Identifiable Information (PII) Report

This form is used to report and provide information on lost, stolen, or compromised personally identifiable information (PII).

DoD Breach Reporting Best Judgment Memo

This Memorandum is to help guide Components toward optimal decision-making regarding PII breach risk and notification determinations.

• Identification #: N/A
• Date: 8/2/2012
• Type: Memorandums
• Topics: Breaches of PII and PHI

TMA Guidelines on Protection of Sensitive Information in Electronic Mail

This Memorandum updates guidelines in Military Health System Chief Information Officer memorandum “Updated Guidelines on Protection of Sensitive Information in Electronic Mail” of September 19, 2008.

• Identification #: N/A
• Date: 11/17/2010
• Type: Memorandums
• Topics: Breaches of PII and PHI

Reporting a Breach as Defined by the Health Information Technology for Economic and Clinical Health Act Provisions of the American Recovery and Reinvestment Act of 2009

This Memorandum outlines the procedures for the Services for reporting a breach as defined by the Health Information Technology for Economic and Clinical Health (HITECH) Act provisions of the American Recovery and Reinvestment Act of 2009.

• Identification #: N/A
• Date: 4/28/2010
• Type: Memorandums
• Topics: Breaches of PII and PHI

Reporting a Breach as Defined by the Health Information Technology for Economic and Clinical Health Act Provisions of the American Recovery and Reinvestment Act of 2009

This Memorandum outlines the procedures for Contractors for reporting a breach as defined by the Health Information Technology for Economic and Clinical Health (HITECH) Act provisions of the American Recovery and Reinvestment Act of 2009.

• Identification #: N/A
• Date: 4/13/2010
• Type: Memorandums
• Topics: Breaches of PII and PHI