WHAT IS A BREACH?
Official Definition:
A breach is the acquisition, access, use, or disclosure of protected health information in a manner not permitted under the Privacy Rule which compromises the security or privacy of the PHI.
Important Presumption:
Any impermissible use or disclosure of PHI is PRESUMED to be a breach UNLESS you can demonstrate through a risk assessment that there is a LOW probability that PHI has been compromised.
This means: BREACH UNTIL PROVEN OTHERWISE!
EXCEPTIONS TO BREACH
There are three statutory exceptions where an impermissible disclosure is NOT considered a breach:
**1. UNINTENTIONAL ACQUISITION, ACCESS, OR USE**
Within scope of authority, made in good faith, no further disclosure
**2. INADVERTENT DISCLOSURE**
Between authorized persons at same entity, no further use
**3. GOOD FAITH BELIEF DISCLOSURE CANNOT BE RETAINED**
Receiving party couldn’t retain the information
BREACH NOTIFICATION REQUIREMENTS
Timeline: 60 days from discovery
**WHO MUST BE NOTIFIED:**
- Affected Individuals (ALWAYS)
2. HHS (ALWAYS)
- Media (IF 500+ individuals)
Required Content:
- What happened
- Types of information involved
- Steps individuals should take
- What entity is doing
- Contact information
HHS Reporting:
- 500+ individuals: Within 60 days
- <500 individuals: Annual report (60 days after year end)
KEY TAKEAWAYS
- Presumed breach unless proven otherwise through risk assessment
- 60-day notification deadline from discovery
- Must notify individuals, HHS, and potentially media
- Documentation required for 6 years
- Prevention is the best strategy