HHS' interim final rule on breach notification released last week included most of the same requirements in the HITECH Act regarding breach notification:
- Immediate notification to victims on all breaches
- Notification to HHS on all breaches (immediate if 500 or more victims)
- Notification to media outlets on breaches of 500 or more patient records
- Valid encryption processes for PHI in databases consistent with National Institute of Standards and Technology (NIST)
However, there is something new and significant—a "harm threshold" provision that will help covered entities and business associates (BAs) determine whether or not to report a breach.
HHS said in the interim final rule that many commenters on the draft guidance in April suggested HHS add a "harm threshold such that an unauthorized use or disclosure of [PHI] is considered a breach only if the use or disclosure poses some harm to the individual."
HHS agreed. Now, covered entities and their BAs will perform a risk assessment to determine if there is significant risk of harm to the individual whose PHI was inappropriately dispensed into the wrong hands.
According to the interim final rule, the important questions are:
- In whose hands did the PHI land?
- Can the information disclosed cause "significant risk of financial, reputational, or other harm to the individual"?
- Was mitigation possible? For example, can you obtain forensic proof that a stolen laptop computer's data was not accessed?
In certain cases, if the information includes only a patient's name and the fact they've had services at the hospital, that's no harm, no breach.
But what if the information includes the patient's oncology treatments? Lots of potential harm there. And that's a breach.
This is good news for covered entities, especially when you look at all those faxes with PHI that go to the wrong address in a hospital. If that fax goes to another HIPAA covered entity who immediately shreds it, no breach notification required.
"It's good news since it appropriately lets organizations off the hook when the breach, as defined by the Recovery Act, doesn't appear to put the patient or plan member at measurable risk," says Kate Borten, CISSP, CISM, president of The Marblehead Group in Marblehead, MA.
Chris Simons, RHIA, director of UM & HIM and the privacy officer at Spring Harbor Hospital in Westbrook, ME, says the harm threshold provision in the interim final rule leaves the rule "nowhere near as strict as I was expecting."
"Privacy officers should be breathing a sigh of relief that those faxes sent by mistake to one doctor instead of another, for instance, will not be required to be reported," Simons adds.
Covered entities and BAs may get off the hook on some breaches with good reason, as cited above. But at other times the harm threshold may lead them down the wrong road, misjudging or underrating the impact of the breach.
"The bad news from a privacy compliance perspective is that while the harm threshold approach requires organizations to perform and document a risk assessment in every instance," Borten says, "introducing the concept of a subjective harm threshold can be seen as a big loophole that some organizations will stretch."