What do you do after a breach has occurred?

Lastly, if the Covered Entity or Business Associate believes the unauthorized person who received the PHI could not retain the information, then it would typically not constitute a breach. Inadvertent disclosures of PHI from one covered entity to another, provided no further disclosure is made, is another situation that is usually not considered a breach. As long as he does not misuse or share that information, it can be deemed an incidental disclosure that does not require breach notification. For example, a nurse might accidentally view the wrong patient in the electronic health record while searching for one of his patients. One type of incident that is not considered a breach is the unintentional access of PHI by someone who has the authority to access PHI. In the event of a potential breach, it is important to consider if the incident might be an exclusion from breaches. Health and Human Services (HHS) defines unsecured PHI as “information that has not been rendered unusable, unreadable, or indecipherable to unauthorized persons.”

Things to inquire about include the information that was viewed or accessed, the unauthorized person who viewed or accessed the information, and the extent that the risk can be mitigated. The Covered Entity or Business Associate will need to conduct a risk assessment to evaluate if the unsecured PHI is likely to harm the patient in any way. The burden of determining if a breach has occurred falls on the Covered Entity or Business Associate. How do you determine if a breach has occurred? Typically, a breach compromises the security and privacy of PHI. A breach is an impermissible disclosure or use of protected health information (PHI).

Hipaa breach notification rule