HIPAA Privacy Breach Investigation
A patient complains that their neighbor, who works as a nurse at the hospital, accessed their electronic health record (EHR) without authorization. The patient discovered this because the nurse mentioned a recent lab result in casual conversation. The hospital's privacy officer initiates an investigation. The EHR audit log shows the nurse accessed the patient's record three times over two weeks, with no documented treatment relationship. The nurse claims they were 'curious' and did not disclose information to anyone else. The hospital has a policy requiring sanctions for privacy violations, including termination for unauthorized access. The privacy officer must determine if this is a reportable breach under HIPAA and what actions to take.
1. Is this a reportable breach under HIPAA? Explain your reasoning.
Read the worked answer
Under the HIPAA Breach Notification Rule, a breach is an acquisition, access, use, or disclosure of PHI not permitted by the Privacy Rule that compromises the security or privacy of the PHI. Unauthorized access by an employee is presumed to be a breach unless the covered entity demonstrates a low probability that the PHI was compromised. Here, the nurse accessed the record without a treatment relationship, and the patient's lab result was mentioned, indicating that the nurse viewed the information. Although the nurse claims no further disclosure, the access itself is a breach because it was not authorized and the information was viewed. The hospital must conduct a risk assessment considering factors: nature and extent of PHI involved (lab results), unauthorized person (nurse), whether PHI was actually acquired or viewed (yes), and mitigation. Given the circumstances, it is likely a reportable breach. The hospital must notify the patient within 60 days and report to HHS if the breach affects 500 or more individuals (here, only one, so annual reporting).
2. What corrective actions should the hospital take, and how should the auditor verify they are effective?
Read the worked answer
Corrective actions should include:
- Sanctions: Follow policy, which may include termination.
- Retraining: Mandatory HIPAA training for the nurse and possibly all staff.
- Access controls: Review and restrict EHR access based on treatment relationships; implement break-the-glass alerts.
- Monitoring: Increase audit log reviews.
- Policy revision: Clarify that curiosity is not a valid reason for access.
To verify effectiveness, the auditor should:
- Review documentation of sanctions and retraining.
- Conduct a follow-up audit of access logs for the nurse and others.
- Assess whether access controls are enforced (e.g., test that unauthorized access triggers alerts).
- Interview staff to gauge awareness.
- Monitor for repeat incidents over 6–12 months.