HIPAA breaches and reporting

HIPAA Breaches - Code Red, Data Spilled

• Breach Definition: An impermissible use or disclosure of Protected Health Information (PHI). It is presumed a breach unless the covered entity can demonstrate a low probability that PHI has been compromised based on a 4-factor risk assessment.

• Notification Timeline: All notifications must occur without unreasonable delay, and in no case later than 60 calendar days after discovery.

• Reporting Requirements:

  • To Individuals: Direct written notification (or email if permitted).
  • To HHS:
    • Affecting ≥500 people: Notify the Secretary of HHS within 60 days.
    • Affecting <500 people: Maintain a log and submit it to HHS annually.
  • To Media: If a breach impacts >500 residents of one state, prominent media outlets in that state must be alerted.

⭐ The 60-day notification clock starts from the moment the breach is discovered, including when it should have been discovered by the organization through reasonable diligence.

Breach Reporting - Sound the Alarm!

• Breach Definition: Unauthorized acquisition, access, use, or disclosure of unsecured Protected Health Information (PHI).
• Notification Obligation: All affected individuals must be notified without unreasonable delay, not to exceed 60 days.
• HHS/OCR Reporting: The timeline hinges on the number of individuals affected.

• 📌 Mnemonic: "MEDIA 500"
  • If a breach impacts 500 or more people, you must notify the MEDIA (and HHS) promptly.

⭐ The burden of proof is on the covered entity to demonstrate that notification was not required. They must produce a risk assessment showing a low probability that PHI was compromised.

Penalties - The Price of Silence

• Civil Monetary Penalties: Tiered system based on the level of culpability, not patient harm.
  • Tier 1 (Unknowing): $100 - $50,000 per violation.
  • Tier 2 (Reasonable Cause): $1,000 - $50,000 per violation.
  • Tier 3 (Willful Neglect, Corrected): $10,000 - $50,000 per violation if corrected within 30 days.
  • Tier 4 (Willful Neglect, Uncorrected): Minimum $50,000 per violation.
• Criminal Penalties: For knowingly obtaining or disclosing PHI.
  • Can result in fines up to $250,000 and imprisonment up to 10 years.

⭐ The annual penalty cap for multiple violations of the same provision is $1.5 million for each penalty tier.

High‑Yield Points - ⚡ Biggest Takeaways

• A HIPAA breach is an impermissible use or disclosure of Protected Health Information (PHI) that compromises its security or privacy.
• Breaches impacting >500 individuals mandate prompt notification to the HHS Secretary and prominent media outlets.
• All affected individuals must be notified without unreasonable delay, and no later than 60 days after discovery.
• For breaches affecting <500 individuals, entities must log them and notify HHS annually.
• The Safe Harbor exception applies if PHI is encrypted per HHS standards.