HIPAA Harm Threshold Works, Say Providers

Dom Nicastro, February 8, 2010

HHS' "harm threshold" standard in its interim final rule on breach notification will prevent healthcare organizations from overwhelming patients with unnecessary breach notification responses, according to providers who work with privacy and security.

At the 18th annual National HIPAA Summit Friday, Judi Hofman, CAP, CHP, CHSS, privacy/information security officer for Cascade Healthcare Community at St. Charles Medical Center in Bend, OR, and Debbie Mikels, corporate manager, confidentiality for Partners Healthcare System in Boston, said the provision published August 24 in the Federal Register gives covered entities the power to prevent unnecessary notifications.

"If you flood your patients with huge concerns, you're going to open up a floodgate of problems in your organization where you really may not have had a risk to start with," Hofman said.

The panelists at the three-day seminar at the Wardman Park Hotel in Washington, DC, responded to a question from an attendee on the controversial harm threshold.

HHS says in the interim final rule that many commenters on its draft guidance in April suggested that HHS add a "harm threshold such that an unauthorized use or disclosure of [PHI] is considered a breach only if the use or disclosure poses some harm to the individual."

Now, covered entities and their BAs will perform a risk assessment to determine if there is significant risk of harm to the individual whose PHI was inappropriately dispensed into the wrong hands.

According to the interim final rule, the important questions are:

  • In whose hands did the PHI land?
  • Can the information disclosed cause "significant risk of financial, reputational, or other harm to the individual"?
  • Was mitigation possible? For example, can you obtain forensic proof that a stolen laptop computer's data was not accessed?

Some Congressmen disagree with the standard.

Six members of the House of Representatives signed a letter on October 1 written to HHS Secretary Kathleen Sebelius that urges HHS to repeal or revise the harm standard provision in HHS' interim final rule on breach notification.

The Congressmen, all but one of whom are Democrats, wrote they are "deeply concerned" about the harm provision because it gives covered entities and business associates (BAs) a "breadth of discretion" as they determine the level of harm to an individual whose PHI was inappropriately disclosed.

Congress explicitly rejected a harm standard when it crafted the American Recovery and Reinvestment Act of 2009 (ARRA), which includes tougher HIPAA enforcement and greater breach notification requirements.

Mikels, of Partners in Boston, said Friday her team is already prepared to conduct its harm risk assessment.

"We have to look at those harm questions," she said.

For instance:

  • Was it a release that went to a person inside your organization to another person that didn't need to know?
  • Does your organization have reason to believe that the PHI wasn't accessed?

"What do I think about [the harm threshold]? Again, it's a balance thing," Mikels said. "I think it makes sense to do a risk assessment. Whoever's the closest to the issue is the one who is best able to look at it and best able to figure out what happened."

Dom Nicastro Dom Nicastro is a contributing writer. He edits the Medical Records Briefings newsletter and manages the HIPAA Update Blog.
Facebook icon
LinkedIn icon
Twitter icon