When does a security incident become a reportable HIPAA breach?

Start

A security incident has been recorded

Most security incidents are not breaches. A breach is a narrower legal event, and the Breach Notification Rule starts from the opposite end to what most people expect: an impermissible use or disclosure of protected health information is presumed to be a breach until you show otherwise. This flow is the assessment that comes before the notification clocks.

• Then: Record when anyone first knew, before assessing

Step

Record when anyone first knew, before assessing

Open the case and record the first day the breach was known, or with reasonable diligence would have been known, to anyone in the workforce or any agent, other than the person who committed it, and who knew first. Every notification clock runs from that time, not from the end of the assessment, so it is fixed now and never reset. Do this before you know whether it is a breach.

• Then: Was PHI used or disclosed in a way the Privacy Rule bars?

Decision

Was PHI used or disclosed in a way the Privacy Rule bars?

Ask whether protected health information was acquired, accessed, used or disclosed in a manner the Privacy Rule does not permit. A failed login attempt, or an infection of a system holding no PHI, is a security incident and not a breach. Ransomware that encrypts ePHI is different: HHS treats the ePHI as acquired, so as a disclosure the Privacy Rule does not permit, and presumes a breach unless you show a low probability of compromise or the ePHI was secured. Answer Yes for it. Other malware is a fact-specific question. If you cannot yet tell whether PHI was reached, take the cautious branch and keep assessing.

• Yes, or not known: Was the PHI secured: encrypted to HHS guidance, or destroyed?
• No: Not a breach: file the record with the incident case

Decision

Was the PHI secured: encrypted to HHS guidance, or destroyed?

Notification duties apply only to unsecured PHI. PHI is secured only if it was encrypted as HHS guidance describes and the key was not compromised, or destroyed as the guidance describes. HHS says the key must not have been breached and should be kept apart from the data, so a key kept on the lost device needs a recorded reason to believe it was not compromised. Redaction is not destruction, and encrypting a system for the Security Rule does not by itself settle it. Full-disk encryption may protect the data while the device is powered down, but many solutions decrypt files transparently once it is on, so record whether the device was shut down. If you cannot show how you know, answer No.

• Yes, shown by the evidence: Secured PHI: no HIPAA notice, keep the evidence
• No, or not known: Does one of the three exclusions apply?

Decision

Does one of the three exclusions apply?

The three exclusions are narrow and each needs facts: an unintentional access by a workforce member or person under your authority, in good faith and within the scope of authority; an inadvertent disclosure between people authorised at the same entity or arrangement; and a good faith belief that the recipient could not have retained the information. The first two need no further impermissible use or disclosure. If unsure, answer No.

• Yes: Excluded: file the record and fix the cause
• No, or not known: Assess the four factors and record the facts for each

Step

Assess the four factors and record the facts for each

No exclusion applies, so the event is presumed to be a breach. Assess at least the nature and extent of the information and the likelihood of re-identification, the unauthorised person who used or received it, whether it was actually acquired or viewed, and how far the risk has been mitigated. Write down the facts for each. A factor that is Not known is not Lower: it counts against you.

• Then: Is a low probability of compromise demonstrated?

Decision

Is a low probability of compromise demonstrated?

The burden is the organisation's. 'We found no evidence of misuse' does not meet it, and neither does a recipient's word that a file was deleted if nothing shows it. Low probability must be demonstrated from the facts you recorded, not assumed. Take Not known while any factor still lacks the facts, and treat the event as a breach until they are found.

• Yes: Low probability demonstrated: keep the record as your proof
• No: Are we the business associate, not the covered entity?
• Not known: Treat it as a breach for now and keep assessing

Step

Treat it as a breach for now and keep assessing

Do not hold the hand-over for a perfect assessment: the notification clock does not wait. Pass on what is known with what is unknown marked, so the notification procedure can start, and keep finding the facts. New facts can reverse the conclusion either way, so revisit the record when they arrive.

• Then: Are we the business associate, not the covered entity?

Decision

Are we the business associate, not the covered entity?

The assessment is the same for both, and both carry the burden of proof. Who is told, and by whom, differs. A covered entity answers to the individuals and the regulator. A business associate tells the covered entity it serves. If you hold both roles, use the role you held for this PHI. If you do not know which you are, do not guess: settle it with counsel.

• Yes: Business associate: prepare to tell the covered entity
• No: Covered entity: prepare the notices to individuals and the regulator
• Not known: Settle the role with counsel and hand over what you know now

Step

Settle the role with counsel and hand over what you know now

The notices differ by role, so a wrong guess sends the wrong notice. Ask counsel to confirm the role now, and use the role questions in “Is our organisation a HIPAA covered entity, a business associate, or neither?” for the facts. Do not wait for the answer to start the hand-over: pass on what is known and mark the role as unconfirmed. The clock does not wait.

• Then: Sign the assessment: privacy lead and security official

Step

Business associate: prepare to tell the covered entity

A business associate that discovers a breach of unsecured PHI tells the covered entity and identifies each individual affected, with what the covered entity needs for its own notice. The agreement may ask for more than the Rule, such as every security incident, so report what it asks even where the assessment says the event is not a breach. Your duty is P09's business associate notice rule, RD-20. A subcontractor tells the business associate that engaged it, as its agreement requires; that business associate then has its own duty to the covered entity (164.314(a)(2)(iii); 164.410).

• Then: Sign the assessment: privacy lead and security official

Step

Covered entity: prepare the notices to individuals and the regulator

A covered entity moves to the notices to each individual, to the media where the rule's threshold is passed, and to the Secretary of Health and Human Services. Count the people affected and note the State each lives in; the clocks and thresholds are held in the notification procedure, not here. If a business associate reported the breach, ask counsel when your own discovery fell.

• Then: Sign the assessment: privacy lead and security official

Step

Sign the assessment: privacy lead and security official

The privacy lead and the security official sign the assessment, and counsel confirms the breach decision. Where one person holds both roles, a second person reviews and signs. Where the signers disagree, the more cautious outcome stands until counsel and the person who decides to report have resolved it. The assessment feeds the decision to report under your incident process and does not replace it. Keep it, with the evidence for each factor, for the retention period the procedure sets.

• Then: Breach of unsecured PHI: hand over to the clocks

Outcome

Breach of unsecured PHI: hand over to the clocks

Pass on the signed assessment, the case number, the time of discovery exactly as recorded, your role, the types of PHI, each individual affected with the State, what has been done, any law-enforcement statement and what is still unknown. Pass no deadline: the clocks are in P09's HIPAA reporting duties (RD-17 to RD-20) and P18-A09. “When do we have to notify a US regulator or the people affected, and under which law?” screens the other US duties and “When one incident triggers HIPAA, State law and a customer contract, which clock runs first?” orders the clocks.

Outcome

Not a breach: file the record with the incident case

No impermissible use or disclosure of PHI means no Subpart D notification duty. Record why, in a line that shows the facts, and handle the event as a security incident under your response process. The privacy lead and the security official sign this outcome too, and counsel confirms it. If you are a business associate, your agreement may still ask you to report it to the covered entity. State laws can still ask you to tell someone.

Outcome

Secured PHI: no HIPAA notice, keep the evidence

Secured PHI is outside the notification duties. The event is still a security incident and is documented with its outcome. File the evidence of encryption or destruction, including where the key was kept. The privacy lead and the security official sign this outcome too, and counsel confirms it. If you are a business associate, your agreement may still ask you to report it to the covered entity. State breach laws differ from HIPAA's and some cover information HIPAA does not, so check them separately.

Outcome

Excluded: file the record and fix the cause

File the record with the facts the exclusion rests on, and fix the cause. No Subpart D notification duty follows. If a further impermissible use or disclosure comes to light, the exclusion falls and you reassess. The privacy lead and the security official sign this outcome too, and counsel confirms it. If you are a business associate, your agreement may still ask you to report it to the covered entity.

Outcome

Low probability demonstrated: keep the record as your proof

File the assessment. Because the burden is yours, it is the proof that the event was assessed. Fix the cause, and review the record when new facts arrive, because they can reverse the conclusion. The privacy lead and the security official sign this outcome too, and counsel confirms it. If you are a business associate, your agreement may still ask you to report it to the covered entity.