QUESTIONS / PRIVACY INCIDENTS
Is this a breach?
A laptop goes missing. Records go to the wrong fax number. A staff member clicks a phishing email. A vendor reports a security incident. Now you need to know what you owe patients and regulators.
WHAT YOU’RE ASKING
Is this a reportable breach, who do we have to notify, and by when?
WHY IT MATTERS?
Under HIPAA, an improper use or disclosure of patient information is presumed to be a breach unless a documented risk assessment shows a low probability that the information was compromised. If it is a breach, affected patients must be notified without unreasonable delay and no later than 60 days after discovery. HHS must be notified too, and large breaches also require notice to the media.
State breach laws can add their own requirements. The clock usually starts when the incident is discovered, so early decisions matter.
WHAT TO DO FIRST
Contain the incident and stop further disclosure
Keep logs, emails and devices as they are
Write down when and how the incident was discovered
Call counsel before notifying anyone outside the practice
WHAT WE REVIEW
What happened, what information was involved, and who received it
The HIPAA four-factor risk assessment
Notices to patients, HHS, the media and state authorities
Vendor and business associate obligations
Cyber insurance notice requirements
Steps to prevent it from happening again
WHAT YOU LEAVE WITH
A documented decision on whether notification is required, notices that meet the rules if it is, and updated safeguards.
Free 30-minute consultation
Speak directly with a healthcare attorney Reza Ghafoorian, MD, JD. No charge and no obligation.