A practice finds a breach of patient data: who does it tell, and by when?

If your practice sends claims electronically, the definition describes it. The same section lists what a transaction is, and the first item is "Health care claims or equivalent encounter information". A practice that bills an insurer electronically is sending one. Whether HIPAA reaches your practice is a conclusion for your counsel; this page assumes it does and goes from there.

The rules in this brief are 45 CFR 164.400 to 164.414. They cover a breach of unsecured protected health information, which the rule shortens to PHI. The notice to patients is at 164.404, the media at 164.406, HHS at 164.408, a vendor's notice to you at 164.410, the police delay at 164.412 and the burden of proof at 164.414. Each is quoted below where it comes up.

Three things are excluded. The definition carves out an unintentional acquisition, access or use by a workforce member "made in good faith and within the scope of authority" that goes no further; an inadvertent disclosure between two people at the same practice who are both allowed to see the information, where it goes no further; and a disclosure where the practice "has a good faith belief that an unauthorized person to whom the disclosure was made would not reasonably have been able to retain such information". A letter handed back unopened is the usual example of the last one.

Everything else is presumed to be a breach. Outside those three, an impermissible acquisition, access, use or disclosure "is presumed to be a breach unless the covered entity or business associate, as applicable, demonstrates that there is a low probability that the protected health information has been compromised based on a risk assessment of at least the following factors". The four factors are the nature and extent of the information, including the identifiers and the likelihood of re-identification; the unauthorized person who used it or received it; "Whether the protected health information was actually acquired or viewed"; and how far the risk has been mitigated.

Write the assessment down, because the burden is yours. Under 164.414(b) the practice "shall have the burden of demonstrating that all notifications were made as required by this subpart or that the use or disclosure did not constitute a breach". So a decision not to notify is only as good as the written assessment behind it. Keep a blank one ready, with the four factors as headings, so the first hour after an incident isn't spent working out what to write.

The methods are in HHS guidance, and this page doesn't restate them. The rule points to guidance from the Secretary for what makes information secured. That guidance is not one Claremont has verified against its text. So this page names no method, encryption or any other, as the one that takes a breach outside these rules. Ask your counsel or your IT provider to read the guidance itself before relying on it.

What follows if the information was secured. The notices in this subpart are owed for a breach of unsecured PHI. If the information met the guidance, these particular notices are not owed. Other duties can still apply, and state law has its own definitions, which the last section comes back to.

Under 164.404(c)(1) the notice "shall include, to the extent possible":

1. "A brief description of what happened, including the date of the breach and the date of the discovery of the breach, if known;"
2. "A description of the types of unsecured protected health information that were involved in the breach (such as whether full name, social security number, date of birth, home address, account number, diagnosis, disability code, or other types of information were involved);"
3. "Any steps individuals should take to protect themselves from potential harm resulting from the breach;"
4. "A brief description of what the covered entity involved is doing to investigate the breach, to mitigate harm to individuals, and to protect against any further breaches; and"
5. "Contact procedures for individuals to ask questions or learn additional information, which shall include a toll-free telephone number, an e-mail address, Web site, or postal address."

In plain language, by mail. Paragraph (c)(2) says the notice "shall be written in plain language". Paragraph (d)(1)(i) sets the method: "Written notification by first-class mail to the individual at the last known address of the individual or, if the individual agrees to electronic notice and such agreement has not been withdrawn, by electronic mail." So email is for patients who agreed to it, and the practice should be able to show the agreement. The rule lets the notice go out "in one or more mailings as information is available", so a first letter needn't wait for every fact.

When you can't reach people. Where contact details are missing or out of date for fewer than 10 people, (d)(2)(i) allows "an alternative form of written notice, telephone, or other means". For 10 or more, (d)(2)(ii) requires either "a conspicuous posting for a period of 90 days on the home page of the Web site" or "conspicuous notice in major print or broadcast media", plus "a toll-free phone number that remains active for at least 90 days". That phone number is the item practices forget to budget for.

Urgent cases can add a phone call. Where the practice thinks misuse is imminent, (d)(3) lets it reach people by telephone or other means as well. The written notice still goes out.

A written request holds the notice for the time it names. Under 164.412(a), where a law enforcement official states in writing that a notice "would impede a criminal investigation or cause damage to national security" and "specifies the time for which a delay is required", the practice delays for that time.

A spoken request holds it for 30 days at most. The practice writes down what was said and who said it, and waits no longer than 30 days unless a written statement arrives in the meantime. The delay covers any notice under the subpart, so the patient letters, the media notice and the HHS report can all wait together. The record of the request is what the practice shows later for why they did.

The vendor tells you; its clock runs from its own discovery. A billing company, a transcription service or an IT provider that holds patient information for you is a business associate, and 164.410 puts a notice to the practice on it. Its 60 days run from the day its own people knew or should have known, under 164.410(a)(2). The notice has to include "the identification of each individual" affected, as far as the vendor can, and any other information you need for the patient letters, "at the time of the notification ... or promptly thereafter as information becomes available".

The patient letters still come from you. Section 164.404(a)(1) puts the notice to individuals on "A covered entity". The vendor's notice to you doesn't discharge it, and your own 60 days run from the day your practice discovered the breach. A business associate agreement can assign the mailing to the vendor as a task, but the rule keeps the duty with the practice.

Check the agreement says so. The contract a practice signs with a business associate has to provide that the vendor will "Report to the covered entity any use or disclosure of the information not provided for by its contract of which it becomes aware, including breaches of unsecured protected health information as required by § 164.410", under 164.504(e)(2)(ii)(C). If an agreement in your files doesn't say it, that is worth fixing before it is tested.

Wisconsin's statute does not apply to a covered entity that complies with Part 164. Section 134.98(3m) lists the entities the Wisconsin breach statute does not apply to, and (b) names an entity described in 45 CFR 164.104(a). That paragraph lists health plans, clearinghouses and health care providers who send covered transactions electronically. The condition is compliance with Part 164, so a practice that meets the HIPAA notices is the one the carve-out describes. Whether your practice is inside it is for counsel.

Other states differ. Every state has its own breach statute, and they don't all treat HIPAA the same way. State law follows the people whose information was involved, so a practice near a state line can owe notices under two statutes. Rather than list fifty statutes here, the breach deadline calculator takes the states your patients live in at step 3 and prints each state's notice beside the HIPAA ones.