A nurse at Health Facility D mistakenly hands patient X's after visit summary to patient Y. Patient Y holds the after-visit summary for about 2 minutes. The after-visit summary contained the patient's first and last name, MRN, address, prescription details, and doctor visit notes. The nurse realized her mistake, and immediately recovered the after-visit summary from patient Y. Health Facility D is a licensed facility.

1.Was there a privacy breach?

2.Is the breach reportable under California and/or federal regulations? [Please indicate and explain if any regulatory exceptions apply (e.g. HIPAA breach exceptions).]

3.To whom should the breach be reported (if applicable)?

4.What recommendations do you have for the Covered Entity as a result of the potential breach (e.g. internal policies, employee sanctions, etc.)?