Effective Date: 



Form 0402 is used by staff, clients, business associates and service providers to report an incident involving an individual's protected health information or sensitive personal information.


Send the completed Form 0402 to Privacy@hhsc.state.tx.us. If you have questions, contact the Privacy Office at 1-877-378-9869.  Note: The entire form must be completed. If any fields are left blank, the Privacy Office staff will return the form for completion.

Detailed Instructions

Initial (date/time) (This form will be resubmitted with additional information, if and when it is available.)

– Enter the date and time the report is created and reported to the Privacy Office.

Final Report (date) – Enter the date of the follow-up or the final report.    

Section I. Person Calling/Reporting the Incident

Date of Discovery – Enter the date the incident was reported to the Texas Health and Human Services Commission.

Caller’s/Person’s Name – Enter the first and last name of the person reporting the incident.

Caller’s/Person’s Phone No. – Enter the area code and phone number of the person reporting the incident.

Caller’s/Person’s Case No. – Enter the case number, eligibility determination group (EDG) number, or individual’s number, if applicable, of the person reporting the incident.

Description of Incident – Provide a brief description of the incident explaining when, why and how the incident occurred and any information pertaining to the investigation of the incident.

Example:  On June 1, 2016, Jane Loghollow contacted the 2-1-1 call center and stated that she received mail for John Doe at her address at 12345 Main Street, Austin, TX 78759. John Doe's case number is 1911223344. Ms. Loghollow does not know John Doe and does not want his mail sent to her address.

Example:  Caller J.J. Banstoneyside, Case No. 1000000000, contacted the call center to report that he received correspondence for an unknown individual at his address.  C.C. Danshorn's Case No. 1999999999 address before her last application submitted on June 23, 2016, was 123 Main Street, Lubbock, TX 79401. On June 23, 2016, Ms. Danshorn submitted a self-service portal application listing her new address as 456 Main Street, Lubbock, TX 79414. On the same day, Ms. Danshorn opted out from receiving notices via mail. An H1013 Opt-Out Notice was generated and mailed to 123 Main Street, Lubbock, TX 79401. On June 24, 2016, HHSC worker Louise Lane processed Ms. Danhorn's application, application registration was performed, and the address was updated. Correspondence was mailed to Ms. Danhorn's correct address at 456 Main Street, Lubbock, TX 79414.    

HHS Enterprise Administrative Report and Tracking System No. – Enter the tracking number, if applicable.     

Sanctions and Corrective Action – Provide details of the sanctions and/or corrective action already taken, if applicable at the time the form is completed.

Sanction Examples: Employee counseling, coaching, re-training, HIPAA training or termination.

Corrective Action Examples:  Case address corrected, client added to the correct case, client removed from the wrong case, delinked documentation from the wrong case and relinked to the correct case, evaluate and improve business processes.

Section II. Improper Disclosure of Information – This section collects basic information about the person whose data was disclosed.

Head of Household – Enter the head of household’s first and last name, if applicable.

Client’s Name – Enter the client’s first and last name.

Client’s Case No. – Enter the client’s case number.

Client’s Date of Birth – Enter the client’s date of birth.

Client’s Social Security No. (last 4 digits) – Enter only the last 4 digits of the client’s Social Security number.

Client’s Address Where Mail is Sent – Enter the client’s mailing address.

Client’s City – Enter the city.

Client’s State – Enter the state.

Client’s ZIP Code – Enter the ZIP code.

Type of Data Disclosed – Check all boxes that apply for data that was disclosed. If the box for Other is checked, list the information that was disclosed.  Examples: EBT card, lab results, income information, benefit information, W-2 form, etc.  Do NOT use protected health information as a type of data disclosed.

Section III. Person Who Received the Information (This may be the same as Section 1.) – This section is used to collect basic information about the person or organization that received the information in error.

Recipient’s Name – Enter the name of the person who received the information in error.

Recipient’s Phone No. – Enter the area code and phone number for the recipient.

Recipient’s Address – Enter the mailing address.

Recipient’s City – Enter the city.

Recipient’s State – Enter the state.

Recipient’s ZIP Code – Enter the ZIP code.

Having trouble viewing or downloading a form?

Get Help