My last post focused on the discovery and investigation of a data security breach to determine if breach notification is needed. Today’s post now turns to the requirements of breach notification triggered by a data security breach.
When a breach is discovered and a covered entity (CE) determines that unsecured ePHI has been compromised, that entity must notify all individuals whose information was affected by the breach without unreasonable delay, defined as within 60 calendar days from discovery of the breach.[1] Discovery is legally defined as having occurred on the first day the breach is known or should have known.[2] This definition means that the clock begins running from the moment the breach is or should have been discovered. This requirement means that an investigation must be conducted quickly and efficiently after discovery of the incident, so that determination of the necessity of notification occurs quickly and breach notification, if necessary, is timely.
If breach notification is required, the patient notice of the security breach should contain the following:
In addition, the breach notification should be written in plain language[3] that the average patient can understand.
A CE must also inform the Secretary of HHS, when a breach occurs that triggers notification provisions. If the breach affects less than 500 people, the CE can log the breach and present it with all other breaches in an annual report within 60 days of the end of the calendar year.
If more than 500 people are affected, the notice must be contemporaneous with the other required notices. In other words, a large data breach requires more immediate reporting to HHS.
When more than 500 residents of a state or jurisdiction are affected by the breach, the covered entity must notify all “prominent media outlets serving the State or jurisdiction.”[4] This option is not pleasant and can seriously damage a CE’s reputation. As a result, CEs need to be vigilant in monitoring and strengthening its security systems to prevent large data breaches. The bad press and financial consequences that a media publication may bring is incentive to review compliance with the Security and Privacy rules and take further steps to encrypt all ePHI.
Business Associates (BA) have similar timelines in terms of notification, but a BA is only required to notify the CE. HHS commentary to the regulations states, however, that if the BA is acting as an agent of a covered entity, the BA’s discovery of a breach will then be imputed to the CE itself, starting the notification countdown, not when the CE receives notice of the breach, but when the BA discovers it. This is a particularly troubling result, as a BA that delays in reporting a breach to a CE could significantly shorten the 60 days window for a CE to notify affected individuals.
CEs and BAs should continually monitor and reevaluate their security systems that store, transmit, use PHI, in light of modern security standards and data breaches. As has been shown by the data breaches at Anthem, Target and Sony, no entity can be too careful in the protection of client data.
For more information on compliance issues with HIPAA Security and Privacy Rules or how to mitigate the damage done in an ePHI data breach, contact the attorneys at McBrayer.
Services may be performed by others.
This article does not constitute legal advice.
[1] 45 CFR 164.404(b)
[2] 45 CFR 164.404(a)(2)
[3] Ibid.
[4] 45 CFR §164.406(a)
