HIPAA Breach Notification – Part II (Determining Whether a Breach Has Occurred)
In a previous post we provided a brief overview of the new privacy breach notification requirements under HIPAA (as amended by the HITECH Act), as they relate to employer-sponsored group health plans. This post will focus on determining whether a privacy breach has occurred, including the exceptions and the all important risk assessment.
The determination of whether a privacy breach has occurred and notification is required involves a three step process: (1) a threshold investigation as to whether an unauthorized acquisition, access, use or disclosure of unsecured PHI has occurred; (2) a determination as to whether an exception could apply to completely mitigate the breach; and (3) a judgment regarding the nature of the breach and the likelihood that the individual whose PHI was breached will suffer some kind of significant harm. As noted in the earlier post, the term "unsecured PHI" means PHI that is not encrypted or otherwise rendered unintelligible or unusable. Since very few employers have both the ability and the inclination to meet the high standards for security set by HHS, we will assume that the PHI involved is unsecured.
Step 1: Threshold Investigation. The first step is to determine whether in fact unsecured PHI was accessed, used or obtained by someone who was not authorized to see or use it or whether it was disclosed to someone who was not authorized to see or use it. The potential breach could take any number of forms – a paper file or report containing PHI left in the company cafeteria, a laptop containing PHI files accidentally left on a train or some other public place, an e-mail containing PHI sent to the wrong address, an EOB sent to the wrong address, a person from the legal department accidentally receiving an employee's PHI file attached to the employee's personnel file. Any of those circumstances would rise to the level of a potential breach and trigger the next step in the process.
Step Two: Availability of an Exception. Three types of impermissible use or disclosure of PHI are not considered breaches: (1) an unintentional access or use of PHI by someone who generally has authority to work with PHI, so long as the access or use was made in good faith, within the scope of authority and does not result in a further use or disclosure of the PHI in an impermissible manner; (2) an inadvertent disclosure by a person who is authorized to access the PHI, so long as the information received as a result of the disclosure is not further used or disclosed in an impermissible manner; and (3) a disclosure of PHI where the plan has a good faith belief that an unauthorized person to whom the disclosure was made would not have been able to retain such information. Therefore, for example, if the person from legal had authority to work with PHI (under the company's HIPAA policies), the inadvertent transmission of an employee's PHI to her would not be problematic. Similarly, an e-mail containing PHI about Employee B that was sent to an authorized business associate who was supposed to receive PHI about Employee A should not create a breach. (In each of those cases, of course, the recipient should ensure that the PHI is immediately returned without further use.) If the plan reasonably determines that one of the foregoing exceptions applies, the plan may appropriately determine that a breach has not occurred.
Step Three: Risk of Harm Assessment. Finally, even if the access, use or disclosure of unsecured PHI cannot qualify for any exception, the regulations provide one last opportunity to nullify the breach and avoid providing the notice. In short, a breach won't "count" if it does not pose a significant risk of financial, reputational or other harm to the person involved. In making this risk assessment, the plan may take into account: (1) the type of PHI involved; (2) the actions taken to mitigate the potential harm resulting from the breach, and the timeliness of such actions; and (3) the likelihood of financial, reputational or other harm resulting to the individual. Take the case of the forgotten laptop. If the owner of the laptop recovers the laptop within a very short period of time and can confirm that no one accessed any files, the likelihood of any harm having occurred would be minimal or non-existent. (Of course, the laptop and all PHI files were password protected as required under the company's HIPAA privacy policies.) If the laptop is not recovered, however, there is probably at least some risk of harm (even with the password protections.) In that case, one would have to ask what kind of health information the files contained. (See our prior post's example of a misdirected EOB.) If the plan reasonably determines that no significant risk of harm to the individual could result from the access, use or disclosure of unsecured PHI, the plan may appropriately determine that a breach has not occurred.
Two final items to note. First, all these requirements apply to "business associates" (i.e., plan service providers who are authorized to work with PHI). Second, like other HIPAA privacy requirements, the breach notification regulations require a plan to document its policies and procedures in order to demonstrate compliance. We recommend simply adding a section on breach notification to your existing set of HIPAA privacy and security policies, though many of our clients opted to simply restate their entire policy manuals. (You do have written HIPAA privacy policies, right?)
