Technical Bulletin | Issue 8 | 2009
HIPAA Privacy Breach Notification Regulations
On August 24, 2009 Health and Human Services (HHS) issued interim final regulations implementing the HIPAA Privacy Breach Notification requirements contained in the American Recovery and Rein-vestment Act (ARRA). ARRA, which was enacted in February, added a new notification requirement when an individual’s “unsecured” protected health information (PHI) is breached. Breach notifications will be required for any breach occurring after September 22, 2009. Regulations issued on April 27, 2009 provided guidance on when PHI is “unsecured.” These new regulations provide additional guidance in key areas including:
• What constitutes a “breach”
• To whom must the new breach notification be sent • What information needs to be included in the notices • When and how must notices be provided
This Technical Bulletin addresses the guidance provided by HHS for privacy breach notification requirements for HIPAA covered entities and business associates. (The Federal Trade Commission (FTC) issued similar regulations for vendors of Personal Health Records (PHR) on August 25, 2009 which are not discussed in this Technical Bulletin.)
What is a Breach
ARRA defines a “breach” as the:
“unauthorized acquisition, access, use, or disclosure of protected health information which compromises the security or privacy of the protected health information, except where an unauthorized person to whom such information is disclosed would not reasonably have been able to retain such information.”
A breach requires notification when a covered entity or business associate experiences a breach of “unsecured” PHI. Encryption is not required under HIPAA. Encryption is an addressable implementa-tion specificaimplementa-tion under HIPAA Security rules. However, informaimplementa-tion encrypted using HHS specified methods is “secured.” Notification is not required under HIPAA (but may be under a state law) if the PHI that was breached was “secured.” For more information on HHS’s April 27 regulations defining “unsecured” PHI, please see our Technical Bulletin 2009-06 at: http://ajg.acrobat.com/p39622661/ HHS provides additional guidance on what constitutes a breach which triggers the notification require-ment:
• The information breached is PHI. The breach notification requirement does not apply to information that is not PHI – such as de-identified information.
• There has been an unauthorized acquisition, access, use or disclosure. Unauthorized means acquisition, access, use or disclosure that is not permitted under HIPAA privacy rules. If there is no HIPAA privacy violation, there is no breach. Regulators noted that uses or disclosures involving more than the minimum necessary amount may qualify as a breach.
• Compromises the security or privacy of the protected health information. HHS defines this as “poses a significant risk of financial, reputational, or other harm to the individual.” In order to determine if there is a significant risk, covered entities and business associates will need to perform a risk assessment. In conducting a risk assessment, HHS expects the covered entity or business associate to consider a number of factors such as the type and amount of PHI involved, who accessed the information, and the nature of the PHI. For example, if the PHI is disclosed in violation of the privacy rules, but the recipient is a HIPAA covered entity required to protect PHI, the incident may not be a breach. The number of individuals affected is not a factor in assessing the risk to determine if a breach has occurred. It will affect how notification is provided.
Comment: One possible example of a privacy violation that may not be a breach based on the type of PHI involved is a list of employee’s names & 3rd quarter health care FSA balances (with
no other information). Based on the limited information included it is unlikely that it could be used for a harm.
A limited data set - which is PHI with 16 specific identifiers removed - is considered “unsecured” by HHS unless it is otherwise “secured” under HHS regulations. However, if both the individual’s zip code and date of birth have been removed from the limited data set, HHS has stated that unauthorized access, use or disclosure would not compromise the security or privacy of the PHI. Therefore, it would not be a breach and no breach notification would be required. If either the date of birth or the zip code is included, a risk assessment must be performed to determine if a breach has occurred.
ARRA includes three exceptions to the breach rule. These exceptions are situations where a HIPAA privacy violation has occurred, but the violation would not be considered a “breach.” Those exceptions along with HHS guidance are:
1. Unintentional acquisition, access or use of protected health information by an employee or individual acting under the authority of a covered entity or business associate, if the acquisi-tion, access, or use was made in good faith, within the course and scope of employment or other professional relationship, and does not result in further use or disclosure. HHS used an example where a billing employee opens an e-mail with PHI mistakenly sent by a nurse. The billing employee realizes he is not the intended recipient, notifies the nurse of the mistake and deletes the e-mail.
2. Inadvertent disclosure of PHI from a person who is authorized to access PHI at a facility to another similarly situated person authorized to access PHI at the same facility if the information is not further used or disclosed without authorization. Inadvertent disclosures of PHI from a person who is authorized to access PHI at a covered entity or business associate to another person authorized to access PHI at the same covered entity or business associate are also exceptions. Regulators did not include a specific example for this exception.
3.The unauthorized person to whom PHI has been disclosed would not reasonably have been able to retain the information. HHS gave two examples. In the first example, a health plan
sends EOBs to the wrong person. The envelopes are returned by the post office unopened and marked undeliverable. In this case no breach occurred. If, however, any of the enve-lopes are not returned, this should be treated as a potential breach. In the second example, a nurse hands a patient someone else’s discharge papers, but realizes her mistake and recovers the papers quickly. If the nurse can reasonably conclude that the patient could not have read the information, this would not be a breach.
If unsecured PHI is accessed, used or disclosed in violation of the HIPAA privacy rules and the incident does not qualify for one of these three exceptions, the covered entity or business associate must conduct a risk assessment to determine if the unauthorized access, use or disclosure will compromise the privacy or security of the individual’s PHI. The covered entity has the burden of proof in making this decision and is required to document its risk assessment and findings.
Comment: One of the purposes of the risk assessment is to limit notifications to situations where there is a significant risk of harm. Too many notifications may confuse individuals. Too many notifications may also make it more difficult for individuals to determine when the situation poses a risk which creates the need for some action on their part.
Unsecured Protected Health Information
Unsecured protected health information is PHI that is not secured through the use of a technology or methodology specified by HHS. The April 27 regulations provide detailed information on the tech-nologies and methodologies which HHS considers will render protected health information unusable, unreadable or indecipherable to unauthorized individuals. In general, only two methods are accept-able – encryption using specific National Institute of Standards and Technology (NIST) standards or destruction.
The August 24 guidance does not add any new methods or technologies for securing PHI. It does, however, make it clear that the term “unsecured protected health information” can include informa-tion in any form or medium including electronic, paper or oral form. In addiinforma-tion, the guidance states that where PHI is encrypted, the encryption or decryption key must be kept on a separate device from the data it encrypts or decrypts to avoid a breach.
The preamble to the regulations also discusses two other methods for securing PHI which HHS considered and specifically rejected. The first is redaction of paper records which HHS does not view as a “standardized methodology with proven capabilities to destroy or render the underlying infor-mation unreadable, unusable or indecipherable.” Only the destruction of paper is deemed secure. The second is the use of access controls such as a firewall. While access controls are required under the HIPAA security rules and important security tools, they will not render the information unread-able, unusable or indecipherable.
Comment: While redaction and access controls are not sufficient to “secure” PHI, they do reduce the potential for unauthorized access. The use of one of these methods may be an important considera-tion during the risk assessment when the covered entity or business associate must determine if an impermissible use or disclosure of PHI constitutes a breach.
Comment: Office of Management and Budget (OMB) memorandum M-07-16 provides information on how federal government agencies have been handling potential breach of personally identifiable information and the subsequent risk assessments. These are pertinent to the HIPPA determination process and the need for breach notifications. While the memo is pre-ARRA, it provides some very
useful information. For a copy of that memorandum:
http://www.whitehouse.gov/omb/memoranda/fy2007/m07-16.pdf
To Whom Must Breach Notification Be Sent
In the event of a breach, the covered entity is required to send notices to affected individuals and Health and Human Services (HHS). In cases where the breach affects more than 500 individuals in a jurisdic-tion, notification must also be made to “prominent” media outlets.
Individual Notifications
Following the discovery of the breach of unsecured PHI, the covered entity must notify every individual whose unsecured PHI has been (or is reasonably believed by the covered entity to have been) accessed, acquired, used or disclosed as a result of the breach.
Notification to Health and Human Services
The covered entity is required to report all breaches to HHS. The method and timing of the report depends on the number of individuals affected by the breach. If fewer than 500 individuals are affected, the covered entity must keep a log and report the breach within 60 days after the end of the calendar year in which the breach occurred. For 2009, this will only include breaches occurring after September 22. If 500 or more individuals are affected by a breach, the covered entity is required to report the breach to HHS as soon as reasonably possible (see “When and How Notices Must be Provided” below). HHS will post the names of covered entities with a breach affecting 500 or more individuals on its web site.
Notification to Prominent Media Outlets
If the breach involves more than 500 individuals in a single State or jurisdiction, the covered entity is required to notify prominent media outlets where affected individuals likely reside. State is defined to include the District of Columbia, the Commonwealth of Puerto Rico, the Virgin Islands, and Guam. Jurisdiction is defined as a geographic area smaller than a State such as a county, city or town.
If the breach involves more than 500 individuals who live in different jurisdictions, media notification is not required. For example, if a breach involves 200 individuals living in Maryland, 200 individuals living in Virginia and 200 individuals living in the District of Columbia, media notification is not required. Notification must be sent to a “prominent” media outlet. HHS states that what constitutes a “prominent media outlet” will differ depending on the State or jurisdiction involved. For a breach affecting more than 500 individuals in a particular State, a prominent media outlet may be a major, general interest newspa-per with a daily circulation throughout the State. A newspanewspa-per serving only one town and distributed on a monthly basis, or a daily newspaper of specialized interest (such as sport, politics) would not be viewed as a prominent media outlet. If the individuals affected by the breach reside in a more limited area such as a city, then a major, general-interest newspaper with daily circulation throughout that city may be a prominent media outlet. A prominent media outlet may also be a major television station where the individuals reside in a city. For larger geographical areas, the media outlet must serve the larger
area. In cases involving more than one jurisdiction, the covered entity may need to notify more than one media outlet.
What Information Needs to Be Included in the Notices
The notice must be written in “plain language” and contain five specific items:1. A brief description of what happened, including the date of the breach and the date of the discovery of the breach, if known;
2. A description of the types of unsecured protected health information that were involved in the breach (such as whether full name, social security number, date of birth, home address, account number, diagnosis, disability code, or other types of information were involved);
3. Any steps individuals should take to protect themselves from potential harm resulting from the breach;
4. A brief description of what the covered entity involved is doing to investigate the breach, to mitigate harm to individuals, and to protect against any further breaches; and
5. Contact procedures for individuals to ask questions or learn additional information, which must include a toll-free number, an e-mail address, web site, or postal address.
The notice should include a description of the type of information involved, but should not include any sensitive information. The covered entity may also wish to include additional information such as a suggestion that the individual contact his or her credit card company or how to contact credit report-ing bureaus, if appropriate.
Instructions for what information to send to HHS will be posted on the HHS website. While not specified, the required information will probably be the same or similar to the information required in the individual notices.
Notification to the media outlet must include the same content as required for the individual notices. The format is not specified, but it may take the form of a press release.
When and How Notices Must be Provided
HHS guidance describes what will be considered timely notice and what methods must be used to provide the required notices. The rules cover notices to individuals, HHS and if required, to major media outlets. The time frame for sending notices is the same for all notices except the notice to HHS for breaches affecting fewer than 500 individuals.
When Must Notices Be Provided
The covered entity is permitted to take a reasonable amount of time to investigate the circumstances to conduct a risk assessment to determine that a breach has occurred and to collect the information which must be included in the notices. Individual notices must be provided without unreasonable delay and in no case later than 60 calendar days after the date the breach is discovered by the covered entity.
Covered entities may provide the required information to individuals with information in multiple mail-ings, as information becomes available, as long as the notices with all of the required content are sent within the 60-day time period. HHS makes it clear that this 60 day time frame is the outer limit for providing notification. If the covered entity has determined that a breach occurs and has the information needed for the notice within 10 days, sending the notice on the 60th day would be an unreasonable delay.
The clock for sending the notices starts when the covered entity “discovers” the breach. Breaches are treated as discovered on the first day that the breach is known, or by exercising reasonable diligence would have been known, to the covered entity. A breach is considered known when any person in the covered entity’s workforce (other than the person committing the breach) knows of the breach. Workforce is defined to include more than just employees. For example, it includes volunteers and trainees who are under the control of the covered entity.
The guidance makes it clear that the 60 day time frame begins when the incident is discovered, not when the covered entity has investigated the event and determined that it constitutes a breach. Covered entities should establish procedures to report incidents and to ensure that workforce members are adequately trained and aware of the importance of timely reporting of privacy and security incidents (as well of the potential consequences for failure to report incidents).
Comment: Covered entities may want to conduct at least some basic training of their workforce since the “discovery” of a security incident by any member of the covered entity’s workforce will start the 60 day clock. Basic training could include information such as what types of security incidents must be reported, how, when and to whom.
A delay is permitted where a law enforcement official determines that the notice would impede a criminal investigation or cause damage to national security. The covered entity may temporarily delay a notifica-tion (including any web site posting) based on an oral request for the time period requested by law enforcement up to 30 days. The covered entity must document the request including the requested delay period and the identity of the law enforcement official. If the law enforcement request is written, the covered entity may delay notification based on the time frame in the written request.
If a business associate of the covered entity is an agent of the covered entity (determined in accordance with the federal common law of agency), the covered entity will be treated as knowing about the breach when the business associate first knows about the breach. If a business associate is not an agent of the covered entity, the business associate must notify the covered entity without unreasonable delay and in all cases within 60 calendar days. (See Notification by a Business Associate below.)
For breaches involving fewer than 500 individuals, information must be reported to HHS within 60 days after the end of the calendar year.
Methods for Providing Notification
Individual notices must be sent via first class mail to the individual’s last known address. Written notice may be provided in the form of electronic mail, provided the individual agrees to receive electronic notice (and has not withdrawn agreement). If the individual is a minor or lacks legal capacity due to a physical or mental condition, the notice may be sent to the parent or other person who is the personal represen-tative of the individual. If the individual is deceased, notice must be sent to the last known address of the next of kin (or a personal representative who has the authority to act on behalf of the decedent or the decedent’s estate if the covered entity has contact information for that person rather than next of kin.)
In some cases the covered entity may not have sufficient contact information for some or all of the affected individuals. In other cases notices may be returned as undeliverable. In these cases the covered entity is permitted to use a substitute form for the notice. Substitute notice must have the same contents and should be provided as soon as reasonably possible after the covered entity realizes that it has incomplete or out of date information. Substitute notice is not required for next of kin of a deceased individual if the covered entity has out of date or no contact information. If there are fewer than 10 individuals for whom the covered entity has incomplete or out of date address information, the covered entity may use an alternative form to provide notification such as telephone or e-mail depending on the information available to the covered entity.
If the covered entity has incomplete or out of date contact information for 10 or more individuals, then substitute notice must be provided through a conspicuous posting on the covered entity’s web site. The posting must be on the home page or provide a prominent hyperlink to the notice on its home page and must include a toll free number for individuals to call with questions or to get more information. The hyperlink should be noticeable and worded to convey the nature and importance of the information. The notice may be located in the login page for existing account holders. The link must be on the web site for at least 90 days. If the covered entity does not have (or prefers not to use) a website, it may post the notice in major print or broadcast media where affected individuals are likely to reside. The notice must be continued for at least 90 days and include the toll free number.
In urgent situations (not defined) where there is a possible imminent misuse of the unsecured protected health information, the covered entity may also provide notice by other means such as telephone. However, this notice must be in addition to the written notice sent via first class mail.
Notification by a Business Associate
Business associates are required to notify a covered entity in the event of a breach of unsecured protected health information. The regulations do not specify to whom or how the business associate will notify the covered entity. In the preamble, HHS states that covered entities and business associates should determine when and how the required reporting will be accomplished. Procedures and time frames agreed upon will need to be incorporated into business associate agreements.
If the business associate is an agent of the covered entity (determined based on the federal common law of agency), the covered entity will be treated as having discovered the breach when the business associate discovers the breach. The rules for determining when a breach is discovered by as business associate are the same as those used by a covered entity. If the business associate in not an agent of the covered entity (i.e. the business associate is an independent contractor), the business associ-ate should notify the covered entity as soon as possible of the breach, but in no event more than within 60 calendar days after discovery.
In all cases, the business associate must provide the covered entity with the names of affected individuals to the extent the business associate has that information. In some circumstances, the business associate may have no or incomplete information about the identity of individuals whose unsecured PHI has been breached. The example included by HHS is a records storage company that stores several hundred boxes of the covered entity’s paper medical records. If several boxes are missing, the record storage company may not know the individuals whose records were contained in the missing boxes.
Since under some circumstances the business associate may be in the best position to gather the information required for the breach notification, business associates are required to provide the covered entity with other information which the covered entity will need for the required notices. Covered entities and business associates are expected to continue to specify in their agreements obligations such as when, how and to whom a breach will be reported and who will send the individ-ual notifications. In some cases, the business associate may be in a better position to provide those notices. The covered entity and business associate should coordinate their efforts to avoid providing duplicates notices.
Comment: While the covered entity and business associate may agree to have the business associ-ate send the individual notices, it appears that the covered entity is required to provide required notification to HHS (and, if needed, the media).
State Laws
In general, HIPAA provides that State laws which conflict will be preempted. State laws which are similar – including those with more stringent requirements – that do not conflict with HIPAA require-ments are not preempted. Currently a number of states have some form (e.g., personal information rather than health information) of breach notification laws. It is HHS belief that generally covered entities will be able to comply with both State laws and HIPAA. However, covered entities will need to review their own State laws to make this determination.
Effective Date
These rules are effective for breaches of unsecured protected health information occurring after September 22, 2009. However, HHS has said they will use their regulatory discretion not to impose sanctions for failure to provide the required notices for breaches that are discovered before February 22, 2010. During this time period they expect covered entities to comply with the rules and will work with covered entities providing technical assistance and voluntary corrective action to achieve compliance.
Action Steps
Even with HHS use of enforcement discretion not to impose sanctions for breaches that are discov-ered before February 22, covdiscov-ered entities (and business associates) have only a short time to become familiar with the new rules and take needed action. Some key action steps are:
1. Review current PHI. Perform an assessment of PHI that the covered entity currently receives, uses, stores or transmits. Determine how much and what type of PHI is involved, who has access, how PHI is received and sent, and how the information is currently pro-tected. Reviewing storage of PHI on portable devices such as laptops, hard drives, CD-ROMs and flash drives will be particularly important since those devices may constitute the greatest risk.
2. Reduce PHI. To the extent feasible, the covered entity may choose to reduce the amount of PHI it uses, stores, receives or shares. The smaller the amount of PHI, the lower the poten-tial for a breach.
3. Inventory PHI. Take inventory of all of the covered entity’s PHI for future reference. The covered entity may also want to reorganize how it handles PHI and/or improve recordkeeping of its paper PHI.
4. Determine if any PHI should be encrypted. Depending on the amount of PHI, type in-volved and the amount of storage and transmission, a covered entity may decide to encrypt some, or all, of its PHI. The covered entity should work with its IT staff to determine if encryption is appropriate.
5. Update Policies & Procedures. Review current policies and procedures, add appropriate provisions and processes to cover the new breach notification rules. This may also be a good time to make any other needed updates (e.g., if there has been a change in how the covered entity uses PHI, this would be an excellent opportunity to update the documentation).
6. Training. The new breach notification rules will have a significant impact on who is trained and how covered entities provide HIPAA training. In the past, the covered entity could limit training to individuals who would have access to PHI such as HR staff. Under the new rules, a breach will be treated as discovered when any member of the covered entity’s workforce becomes aware of the incident. Covered entities may want to provide some training on recognizing and reporting security incidents to all members of its workforce. This may also be an excellent opportunity to update HIPAA training in general and conduct refresher training where needed.
7. Develop Breach Procedures. Create policies and procedures for identifying and responding to security incidents that may constitute breaches. For example, determine what types of incidents workforce members will be required to report, how to report incidents and who must be notified. The covered entity will also need to develop processes for collecting information and sending notices in the event of a breach.
8. Update Documentation. Modify current policy and procedure documents, any training materials such as manuals, the HIPAA privacy policy and notice; and amend the formal Plan document.
9. Amend Business Associate Agreements. Update business associate agreements to include the new breach notification rules. As part of the process determine the roles of the covered entity and business associate in the event that the business associate experiences a breach. As part of this process, it would be prudent for the covered entity to ensure that it has updated information.
10. Monitor Developments. Covered entities may want to check the HHS web site to keep current on developments. The url for the main HIPAA privacy website is:
http://www.hhs.gov/ocr/privacy/
The intent of this Technical Bulletin is to provide general information on employee benefit issues. It should be not construed as legal advice and, as with any interpretation of law; plan sponsors should seek proper legal advice for application of these rules to their plans. © 2009 Gallagher Benefit Services.
