Breach notification basics for practices

What counts as a breach

45 CFR 164.402 defines a breach as the acquisition, access, use or disclosure of PHI in a manner not permitted by the Privacy Rule which compromises the security or privacy of the information.

The key word is presumed. An impermissible use or disclosure is presumed to be a breach unless the practice, or its business associate, demonstrates a low probability that the PHI has been compromised, based on a risk assessment of at least four factors:

1. The nature and extent of the PHI involved, including the types of identifiers and the likelihood of re-identification.
2. The unauthorized person who used the PHI or to whom it was disclosed.
3. Whether the PHI was actually acquired or viewed.
4. The extent to which the risk has been mitigated.

Three exceptions, and the encryption safe harbor

The definition excludes three situations: an unintentional, good-faith access by a workforce member acting within their authority that goes no further; an inadvertent disclosure between two people who are both authorized to access PHI at the same organization; and a disclosure where you have a good-faith belief the recipient could not reasonably have retained the information.

Separately, notification is only required for unsecured PHI: information not rendered unusable, unreadable or indecipherable to unauthorized persons using a method HHS specifies. HHS guidance names encryption consistent with NIST standards, where the key has not also been compromised, and destruction in line with NIST Special Publication 800-88. An encrypted laptop that is stolen, with its key safe, is generally not a reportable breach. An unencrypted one usually is.

Who to notify, and when

Notification duties run in several directions. Every deadline below is an outer limit, not a grace period: the rule requires notice without unreasonable delay, and a breach is treated as discovered on the first day it is known, or by exercising reasonable diligence would have been known, to anyone in your workforce other than the person who caused it.

• Affected patients. Under 45 CFR 164.404, without unreasonable delay and no later than 60 calendar days after discovery. Notice goes by first-class mail, or by email if the patient has agreed to electronic notice.
• HHS. Under 45 CFR 164.408, breaches affecting 500 or more people must be reported to the HHS Secretary at the same time as patient notices. Breaches affecting fewer than 500 people are logged and reported no later than 60 days after the end of the calendar year in which they were discovered.
• The media. Under 45 CFR 164.406, a breach involving more than 500 residents of a state or jurisdiction requires notice to prominent media outlets serving that area, within the same 60-day limit.
• Your practice, if a vendor has the breach. Under 45 CFR 164.410, a business associate must notify the practice without unreasonable delay and no later than 60 days after discovering a breach, identifying the affected individuals. Your BAA can and should require faster notice.
• State authorities. Many states have their own breach laws, some with shorter deadlines or attorney general notice. Check them alongside HIPAA.

What the patient notice must say

45 CFR 164.404(c) requires the notice to be written in plain language and to include:

• A brief description of what happened, including the date of the breach and the date of discovery, if known.
• The types of unsecured PHI involved, such as name, date of birth, diagnosis or insurance information.
• Steps patients should take to protect themselves.
• What the practice is doing to investigate, mitigate harm and prevent a repeat.
• Contact procedures, including a toll-free number, email address, website or postal address.
• If contact information is out of date for 10 or more people, substitute notice is required, such as a website posting or major media notice for 90 days, with a toll-free number active for at least 90 days.

Walking through a common incident

Say a reminder text goes to a number that was reassigned to a stranger. The message reads: "[Practice Name]: you have a visit Tue at 10:30 AM. Reply 1 to confirm. STOP to opt out." The new owner replies "wrong number."

Run the four factors. Nature of the PHI: no patient name, no reason for visit; the only health-related fact is that someone with this old number had an appointment at this practice. Recipient: an unrelated member of the public. Acquired or viewed: yes, it was read. Mitigation: texts to that number stopped immediately and the record was corrected.

Many practices would document this as a low probability of compromise, though the result depends on the facts, including how sensitive the practice's specialty is. Now change one thing: the text named the patient and said "your oncology follow-up." The assessment looks very different. This is why minimum necessary message design matters before anything goes wrong.

The first 72 hours: a practical checklist

1. Contain it: stop the messages, recover the device, revoke the access, call the wrong recipient if appropriate.
2. Write down the facts while they are fresh: who, what, when, how discovered, how many patients.
3. Notify your privacy officer and, if a vendor is involved, require the vendor's written incident report.
4. Run and document the four-factor risk assessment. Under 45 CFR 164.414, the practice bears the burden of showing that notices were made or that the incident was not a breach.
5. Decide on notifications and calendar the deadlines, counting from the discovery date.
6. Fix the cause: retrain, change templates, update vendor settings.
7. File everything. Keep documentation for at least six years under 45 CFR 164.530(j).