Disciplinary and Adverse Actions

Policy Number: 029

Establishes DHA's procedures for taking disciplinary and adverse actions.

HITECH Act

The Health Information Technology for Economic and Clinical Health Act, abbreviated the HITECH Act, was enacted under Title XIII of the American Recovery and Reinvestment Act of 2009.

• Identification #: N/A
• Date: 8/2/2022
• Type: Guidelines
• Topics: Breach Prevention and Response

DODI 5200.48: Controlled Unclassified Information

This issuance establishes policy, assigns responsibilities, and prescribes procedures for CUI throughout the DOD in accordance with Executive Order (E.O.) 13556; Part 2002 of Title 32, Code of Federal Regulations (CFR); and Defense Federal Acquisition Regulation Supplement (DFARS) Sections 252.204-7008 and 252.204-7012. It also establishes the official DOD CUI Registry.

• Identification #: DODI 5200.48
• Date: 3/6/2020
• Type: Instructions
• Topics: Breach Prevention and Response

DOD Instruction 6025.18: Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule Compliance in DOD Health Care Programs

This issuance, in accordance with the authority in DOD Directive 5124.02, establishes policy and assigns responsibilities for DOD compliance with federal law governing health information privacy and breach of privacy; integrating health information privacy and breach compliance with general information privacy and security requirements in accordance with federal law and DOD issuances; health information technology, system interoperability, and exchange of electronic health information, in relation to federal law governing health information privacy and breach; and DOD contracting and procurement activities in relation to federal law governing health information privacy and breach.

• Identification #: 6025.18
• Date: 3/13/2019
• Type: Instructions
• Topics: Privacy & Civil Liberties | Breach Prevention and Response | HIPAA Compliance within the MHS | HIPAA and Privacy Act Training | Privacy Act at DHA

DD Form 2959: Breach of Personally Identifiable Information (2019)

This DD2959 form should be filled out when a breach concerning personally identifiable information occurs.

Guidelines for Reporting Breaches

This document outlines the DOD reporting and notification requirements for breaches.

DoD Instruction 8580.02: Security of Individually Identifiable Health Information in DoD Health Care Programs

This instruction establishes policy and assigns responsibilities for security of individually identifiable health information created, received, maintained, or transmitted in electronic form (referred to in this instruction as “electronic protected health information (ePHI)”).

• Identification #: DoD Instruction 8580.02
• Date: 8/12/2015
• Type: Instructions
• Topics: Privacy & Civil Liberties | Breach Prevention and Response

Plan of Action and Milestone Template

This template is used to track plans of action and milestones regarding potential breaches.

Phishing Overview

An Information Paper that tells what phishing is, how to respond to phishing attacks, and steps to take to avoid becoming a victim of phishing scams.

Malicious Code Overview

An Information Paper that explains what malicious code is, including the various types, the proper response to a malicious code attack, and steps to take to avoid receiving malicious code on a computer system.

Social Networking Overview

An Information Paper that defines social networking, details the Department of Defense's position on this topic, and discusses the responsible use of social networking and Internet-based capabilities.

Examples of PII

Personally identifiable information (PII) is information that identifies, links, relates, or is unique to, or describes you. This also includes information which can be used to distinguish or trace your identity and any other personal information which is linked or linkable to you.

TMA Guidelines on Protection of Sensitive Information in Electronic Mail

This Memorandum updates guidelines in Military Health System Chief Information Officer memorandum “Updated Guidelines on Protection of Sensitive Information in Electronic Mail” of September 19, 2008.

• Identification #: N/A
• Date: 11/17/2010
• Type: Memorandums
• Topics: Breach Prevention and Response

Reporting a Breach as Defined by the Health Information Technology for Economic and Clinical Health Act Provisions of the American Recovery and Reinvestment Act of 2009

This Memorandum outlines the procedures for the Services for reporting a breach as defined by the Health Information Technology for Economic and Clinical Health (HITECH) Act provisions of the American Recovery and Reinvestment Act of 2009.

• Identification #: N/A
• Date: 4/28/2010
• Type: Memorandums
• Topics: Breach Prevention and Response

Reporting a Breach as Defined by the Health Information Technology for Economic and Clinical Health Act Provisions of the American Recovery and Reinvestment Act of 2009

This Memorandum outlines the procedures for Contractors for reporting a breach as defined by the Health Information Technology for Economic and Clinical Health (HITECH) Act provisions of the American Recovery and Reinvestment Act of 2009.

• Identification #: N/A
• Date: 4/13/2010
• Type: Memorandums
• Topics: Breach Prevention and Response