Security Safeguards and Breach Notification
Safeguard Categories
The Security Rule requires administrative, physical, and technical safeguards for ePHI. Administrative safeguards include risk analysis, workforce security, training, and contingency planning. Physical safeguards include facility access controls, workstation use, and device and media controls. Technical safeguards include access control, audit controls, integrity, person or entity authentication, and transmission security. Standards are generally required, while implementation specifications are either required or addressable; addressable does not mean optional-it means assess and implement reasonably or document why not.
Breach Notification
A breach is an impermissible use or disclosure that compromises the security or privacy of PHI, presumed unless a risk assessment demonstrates low probability of compromise. The assessment considers the nature and extent of PHI, the unauthorized person, whether PHI was actually acquired or viewed, and the extent of risk mitigation. Notification to individuals is generally due within 60 days of discovery. Breaches affecting 500 or more individuals require notice to HHS at the same time and media notice; smaller breaches are logged and reported to HHS annually. Business associates must notify covered entities without unreasonable delay and no later than 60 days.
Traps Candidates Miss
- The four-factor risk assessment is not optional and must be documented.
- Encrypted PHI is generally not "unsecured" and may fall outside notification duties.
- Discovery occurs when the breach is known or would have been known with reasonable diligence.
- Addressable specifications still require a decision and documentation.
Rule of Thumb
When a lost device or misdirected email appears in a question, run the four-factor analysis before concluding notification is required; if data was encrypted and the key was not compromised, notification may not be needed.