HIPAA – Policy on Breach Notification and When it is Necessary After an Impermissible Use or Disclosure of PHI

Breach Notification Requirement

Covered entities are required to notify affected individuals, the media in certain circumstances, and DHHS if there is an unauthorized acquisition, access, use, or disclosure of unsecured PHI, subject to certain limited exceptions.  PHI is considered unsecured unless it is encrypted or destroyed through the use of methodologies and technologies specifically approved in guidance issued by DHHS.

If unsecured PHI has been breached, the covered entity must notify affected individuals by first-class mail or by e-mail if e-mail is specified by the individual.  If contact information for fewer than 10 individuals is insufficient or out-of-date, notice may be provided by an alternative form of written notice, telephone, or other means.  If contact information for 10 or more individuals is insufficient or out-of-date, the covered entity must post a notice on the homepage of its website (or through a hyperlink on its homepage) for 90 days or publish a conspicuous notice in print or broadcast media in geographic areas where individuals affected by the breach reside.  If more than 500 individuals in a single state or jurisdiction are affected, notice must be provided to prominent media outlets serving such state or jurisdiction (e.g., in the form of a press release).  If there exists the possibility of imminent misuse of the unsecured PHI, telephone calls to affected individuals may also be appropriate.

Notifications must be made without unreasonable delay and in no case later than 60 calendar days after discovery of the breach.  The notice must include certain specific information.

If the breach involves 500 or more individuals, DHHS must be notified immediately, which will subsequently post the breach on its website.  If the breach involves less than 500 individuals, the covered entity must maintain a log and submit the log to DHHS on an annual basis.

Covered entities and business associates must do the following to determine whether notification is required under the HHS regulations:

• Determine if there has been an impermissible use or disclosure under the HIPAA privacy regulations.
• Determine (and document) if the impermissible use or disclosure compromises the privacy or security of protected health information.
• Determine whether any exceptions apply.
• Determine whether the breach involves unsecured protected health information.

Notification generally is required in the case of an impermissible use or disclosure of unsecured protected health information that compromises the privacy or security of the information.  Below are three exceptions to this rule:

• Unintentional acquisition, access or use: This applies where the acquisition, access or use was made in good faith, within the course and scope of employment or other professional relationship, and does not result in further use or disclosure.
• Inadvertent disclosure: This covers disclosures from an otherwise authorized individual to another similarly-situated individual at the same facility, if the information is not further used or disclosed without authorization. The preamble to the regulations clarifies that “facility” does not mean the particular building, but the same covered entity or business associate.
• Inability to retain the information: This applies where the unauthorized person to whom the protected health information was disclosed would not have been able to retain the information. For example, a human resources employee acting for the company health plan may have sent protected health information to the wrong employee via interoffice mail. If the HR employee retrieves the envelope before the employee could open it, it would not constitute a breach.

Note: Be certain you are dealing with “protected health information” under HIPAA. Employment records, such as FMLA leave certifications or medical documentation obtained in the ADA interactive process, in the hands of the employer do not constitute protected health information, even though the records include individually identifiable health information. Note, however, that breaches of employment records containing health information or other personal information still may require notification under state or other federal regulations.