Is HIPAA's New Harm Threshold Good News or Bad?

Chris Simons, RHIA, director of UM & HIM and the privacy officer at Spring Harbor Hospital in Westbrook, ME, says the harm threshold provision in the interim final rule leaves the rule "nowhere near as strict as I was expecting."

"Privacy officers should be breathing a sigh of relief that those faxes sent by mistake to one doctor instead of another, for instance, will not be required to be reported," Simons adds.

Covered entities and BAs may get off the hook on some breaches with good reason, as cited above. But at other times the harm threshold may lead them down the wrong road, misjudging or underrating the impact of the breach.

"The bad news from a privacy compliance perspective is that while the harm threshold approach requires organizations to perform and document a risk assessment in every instance," Borten says, "introducing the concept of a subjective harm threshold can be seen as a big loophole that some organizations will stretch."