Responding to HIPAA Breaches

HIPAA privacy and security breaches can result in fines of $100 to $50,000 to covered entities (including healthcare providers and health plans) and their business associates. (45 CFR 160.404). If the violation resulted from “willful neglect”, the Office for Civil Rights (“OCR”) must impose a mandatory fine of $10,000 to $50,000. (45 CFR 160.404). To make matters worse, covered entities and their business associates must self-report breaches of unsecured protected health information (“PHI”) to the affected individual and to HHS (45 CFR 164.400); failure to do so may constitute “willful neglect” resulting in additional fines. The good news is that the OCR may not impose a fine so long as the covered entity or business associate did not act with “willful neglect” and corrected the problem within 30 days. (45 CFR 160.410(b)).

Responding to Possible Breaches. Given the potential consequences, it is critical that covered entities and business associates respond appropriately to potential HIPAA breaches to avoid or minimize their liability. Below are steps that you may follow to help you identify and timely respond to HIPAA breaches.

1. Stop the breach. Immediate action may help avoid or mitigate the effects of a breach. Terminate improper access to PHI; retrieve any PHI that was improperly disclosed; and obtain assurances from recipients that they have not, or will not, further use or disclose PHI that was improperly accessed. Document your actions.

2. Notify the privacy officer. Each covered entity must have a designated privacy officer who has the training and experience to properly investigate and respond to a potential breach. Deadlines for responding to breaches generally run from the date that anyone in the organization knew of the breach except the person committing the breach (see 45 CFR 164.404(b); 78 FR 5647); accordingly, workforce members should be trained to notify the privacy officer as soon as they become aware of a breach.

3. Respond promptly. Swift, appropriate action is critical for at least four reasons. First, covered entities have an affirmative obligation to mitigate the effects of any breach. (45 CFR 164.530(f)). Second, prompt action may help avoid or mitigate further breaches, which is an important factor in determining whether a breach is reportable. (45 CFR 164.402). Third, as discussed above, a covered entity or business associate may avoid penalties if they correct a violation within 30 days. (45 CFR 160.410(b)). And fourth, the breach notification rule requires that notice of reportable breaches be given “without unreasonable delay,” but no later than 60 days after discovery. (45 CFR 164.404).

4. Investigate appropriately. Confirm the “who, what, when, why, and how” with persons involved, including persons who committed the alleged violation; persons who may have received PHI improperly; and other relevant witnesses. Confirm the nature and scope of the PHI that was accessed, used. or disclosed, and why they accessed or disclosed the PHI. Ensure there was no redisclosure or will not be any further redisclosure. In your discussions, ensure that you do not inadvertently disclose additional PHI. Also, beware of jumping the gun: sometimes a full investigation reveals additional facts that confirm no reportable breach occurred. Do not report a suspected breach before you have actually concluded that a reportable breach occurred. Document your investigation, including obtaining witness statements or sending confirming letters as appropriate. For example, you may want to send a letter to alleged recipients confirming the extent of their access or disclosure of PHI, and warning them of the penalties that may apply if they further use or disclose PHI improperly. (See 42 USC 1320d-6).

5. Mitigate the effects of the breach. HIPAA requires that a covered entity mitigate any harmful effects of a breach to the extent practicable. (45 CFR 164.530(f)). Mitigation may include retrieving, deleting, or destroying improperly disclosed PHI; terminating access or changing passwords; remote wiping mobile devices; modifying policies or practices; and/or warning recipients of potential penalties for further violations. In some cases, it might include paying for the cost of a credit monitoring service or similar action, and/or notifying affected individuals even if the breach is not reportable under the breach notification rules. The response will depend on the circumstances. If a covered entity knows that a business associate is violating HIPAA, it must either take steps to cure the breach or terminate the business associate agreement. (45 CFR 164.504(e)(1)).

6. Correct the breach. Remember: a covered entity may avoid HIPAA penalties if it did not act with willful neglect and corrects the problem within 30 days. (45 CFR 160.410(b)). Although you may not be able to “unring” the bell, you can ensure that the bell does not continue ringing by, e.g., changing processes; implementing new safeguards; modifying policies; and/or training employees. (See 75 FR 40879).

7. Impose sanctions. HIPAA requires that covered entities have, apply, and document appropriate sanctions against workforce members who violate HIPAA or privacy policies. (45 CFR 164.530(e)). The sanction should fit the crime: it may range from a written warning and additional training to suspension or termination.

8. Determine if the breach is reportable to the individual and HHS. Under the breach notification rule, covered entities are only required to self-report if there is a “breach” of “unsecured” PHI. (45 CFR 164.400 et seq.).

  1. Unsecured PHI. “Unsecured” PHI is that which is “not rendered unusable, unreadable, or indecipherable to unauthorized persons through the use of a technology or methodology” specified in HHS guidance. (45 CFR 164.402). Currently, there are only two ways to “secure” PHI: (1) in the case of electronic PHI, by encryption that satisfies HHS standards; or (2) in the case of e-PHI or PHI maintained in hard copy form, by its complete destruction. (74 FR 42742). Breaches of “secured” PHI are not reportable. Most potential breaches will involve “unsecured” PHI.
    1. Was there a violation of the privacy rule? Breach notification is required only if the acquisition, access, use or disclosure results from a privacy rule violation; no notification is required if the use or disclosure is permitted by the privacy rules. (45 CFR 164l.402). For example, a covered entity may generally use or disclose PHI for purposes of treatment, payment, or healthcare operations without the individual’s authorization unless the covered entity has agreed otherwise. (45 CFR 164.506). Disclosures to family members and others involved in the individual’s care or payment for their care is generally permitted if the patient has not objected and the provider otherwise determines that disclosure is in the patient’s best interest. (45 CFR 164.510). HIPAA allows certain other disclosures that are required by law or made for specified public safety or government functions. (45 CFR 164.512). Disclosures that are incidental to permissible uses or disclosures do not violate the privacy rule if the covered entity employed reasonable safeguards. (45 CFR §§ 164.402 and .502(a)(1)(iii)). When in doubt as to whether a disclosure violates the privacy rule, you should check with your privacy officer or a qualified attorney.


9. If required, report the breach to the individual and HHS. If the breach notification rule requires a report, the covered entity and business associate must make the required reports; HHS has indicated that failure to do so will likely constitute “willful neglect”, thereby triggering mandatory penalties if discovered. (75 FR 40879).

  3. Notice to HHS. The timing of notice to HHS depends on the number of persons affected by the breach. If the breach involves less than 500 persons, the covered entity may wait to report the breach to HHS until no later than 60 days after the end of the calendar year. (45 CFR 164.408(c)). If the breach involves 500 or more persons, the covered entity must notify HHS at the same time it notifies the individual. (Id. at 164.408(b)). Covered entities should submit the report electronically using the form available at http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/brinstruction.html. The OCR posts the names of entities with breaches involving more than 500 persons on the OCR’s wall of shame, https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf.
  4. Notice to Media. If the breach involves more than 500 persons in a state, the covered entity must also notify local media within 60 days of discovery. (45 CFR 164.406). The notification must contain information similar to that provided to individuals. (Id. at 164.408(c)).
  5. Documentation. A covered entity is required to maintain documentation concerning its breach analysis and/or reporting for six years. (45 CFR 164.414 and 164.530(j)).

10. Log the breach in accounting log. Whether or not the breach is reportable to the individual or HHS, covered entities and business associates are still required to record impermissible disclosures in their accounting of disclosure logs as required by 45 CFR 164.528. The log must record the date of the disclosure; name and address of the entity who received the PHI; a brief description of the PHI disclosed; and a brief statement of the reason for the disclosure. (45 CFR 164.528(b)). If requested, the covered entity must disclose the log to the individual or the individual’s personal representative within 60 days. (Id. at 164.528(c)).

Avoiding Breaches. Of course, it is better to avoid a breach rather than respond to one. To that end, covered entities and business associates should ensure that they practice preventive medicine by, among other things, implementing required policies and administrative, technical, and physical safeguards to protect PHI, and periodically monitor compliance. Train and regularly retrain or remind workforce members concerning HIPAA obligations. Use past breaches to improve systems and future performance. Consider purchasing appropriate privacy insurance to cover the costs if breaches do occur, and include indemnification or other provisions in business associate agreements to protect yourself and/or shift the costs of potential breaches.

A sample breach notification policy is available here.

For questions regarding this update, please contact:
Kim C. Stanger


