Mistakes and attacks happen. The Breach Notification Rule requires covered entities and business associates to tell the right people when unsecured PHI is breached.
What a breach is
A breach is the acquisition, access, use or disclosure of PHI in a way the Privacy Rule does not permit, which compromises the security or privacy of the information.
Any impermissible use or disclosure is presumed to be a breach unless the organization shows, through a documented risk assessment, that there is a low probability that the PHI has been compromised. The assessment considers at least four factors:
- the nature and extent of the PHI involved — the types of identifiers and the likelihood of re-identification;
- the unauthorized person who used the PHI or received it;
- whether the PHI was actually acquired or viewed;
- the extent to which the risk has been mitigated — for example, getting assurance that the information was returned or destroyed.
The organization carries the burden of showing that a notification was not required.
Exceptions
Three situations are not breaches:
- an unintentional access or use by a workforce member acting in good faith and within the scope of their authority, if it is not further used or disclosed improperly;
- an inadvertent disclosure from one person authorized to access PHI to another authorized person at the same organization, if not further used or disclosed improperly;
- a disclosure where the organization has a good-faith belief that the unauthorized recipient could not reasonably have kept the information.
Deciding whether an event is a breach is the job of the privacy officer, not the person who made the mistake. Report every incident and let them assess it.
Unsecured PHI and encryption
Notification applies to unsecured PHI — PHI that has not been made unusable, unreadable or indecipherable to unauthorized people by methods HHS specifies, such as proper encryption or destruction. If a properly encrypted laptop is stolen and the key is not compromised, notification is generally not required. This is one of the strongest reasons to use encryption.
When the clock starts
A breach is treated as discovered on the first day it is known to the organization — or would have been known with reasonable diligence. Knowledge of any workforce member (other than the person who committed the breach) counts as knowledge of the organization. That is why you must report right away: the deadlines may already be running when you notice the problem.
Who must be notified
- Individuals — without unreasonable delay and no later than 60 calendar days after discovery, usually by first-class mail (or email if the person agreed). The notice explains in plain language what happened, what information was involved, what people can do to protect themselves, what the organization is doing, and how to get more information. If contact details are out of date for 10 or more people, substitute notice is required — for example, a notice on the organization's website for 90 days or in major media, with a toll-free number.
- HHS — for breaches affecting 500 or more individuals, at the same time as notice to individuals. For breaches affecting fewer than 500, the organization keeps a log and reports them to HHS no later than 60 days after the end of the calendar year in which they were discovered.
- The media — for breaches affecting more than 500 residents of a state or jurisdiction, prominent media outlets serving that area must be notified, also without unreasonable delay and within 60 days.
A business associate that discovers a breach must notify the covered entity without unreasonable delay and no later than 60 days after discovery, identifying the affected individuals where possible. The covered entity is usually the one that notifies patients. Notices may be delayed when law enforcement says notice would impede a criminal investigation.
Many states have their own breach notification laws, sometimes with shorter deadlines. Your privacy officer handles these too.
Scenarios
Paper records in a dumpster. A clinic's old appointment sheets are found in an open dumpster. This is an impermissible disclosure, the paper was not destroyed, and anyone could have taken it. It is likely to be a breach after the risk assessment, and notification deadlines run from the day it was discovered.
An email to the wrong colleague. A nurse emails a patient summary to another nurse at the same hospital who is also authorized to see PHI, but who is not on that patient's care team. The colleague deletes it without reading further. This may fit the inadvertent-disclosure exception — but it is the privacy officer, not the nurse, who decides, so it still must be reported.
Ransomware. Malware encrypts a practice's files and demands payment. HHS treats a ransomware attack on ePHI as presumed to be a breach unless the organization can show a low probability of compromise under the risk assessment.
Key points
- An impermissible use or disclosure is presumed to be a breach unless a four-factor risk assessment shows a low probability of compromise.
- Individuals must be notified without unreasonable delay and within 60 days of discovery.
- 500 or more affected: notify HHS at the same time; more than 500 in one state: notify the media too; fewer than 500: annual report to HHS.
- Properly encrypted PHI is not "unsecured", which is why encryption matters.