Looking for a Business Associate Agreement? Download our FREE starter template.
Total HIPAA Logo

Is it a breach, or not?

This week we had an interesting question come in. One of our clients was copied by a general agent in a response to an application for health insurance. This message contained ePHI that wasn’t encrypted. Was it a breach? What does that mean for the agents? Does the client need to be notified?

We passed this to David Smith for his thoughts, and here is his assessment:

I do not believe there was a breach for either agent in this situation.This is because the information that passed between the parties was between business associates, and therefore there is no requirement that agent that initiated the application notifies the client because this agency has done nothing to breach the HIPAA Privacy, Security or HITECH rules.

However, the general agency is clearly in violation of the HIPAA security requirements concerning encryption of ePHI. This is a very serious issue, and all PHI should be encrypted at rest, and in transit.

The general agency will need to document this violation, and will potentially need to sanction the offending agent. This could be a verbal warning, retraining, or suspension. While this was not malicious, it could still be a serious issue for the general agency. When issues like this arise, you need to act quickly to support your clients, and let people know when they have made mistakes. Remember, sanctions should be clearly notated in your Security Policies and Procedures, and it is important that you enforce them.

I do believe there is value in the initiating agency providing information to the client along the following lines:

  • A company I do business with violated the HIPAA Security requirements related to transmission of electronic health information as a business associate of various health insurance carriers.
  • They have assured me that this was a one-time mistake and that they have taken appropriate corrective action to prevent any future issue.
  • I am letting you know because of the seriousness with which I am taking the responsibility of maintaining the privacy and security of my clients’ information and to assure you that I will remain diligent about any future issues on your behalf.

The key here is letting your clients know if and when there is an issue, so they can be proactive in monitoring their personal information.

By Jason Karn

Google+

Total HIPAA specializes in HIPAA compliance services, helping businesses adhere to HIPAA guidelines and protect sensitive data. Our experts ensure your organization remains compliant with HIPAA regulations, meaning you can focus on your core operations while we handle documenting the policies and procedures that make up your HIPAA compliance plan. Trust Total HIPAA for comprehensive compliance solutions tailored to your needs. Book a clarity call today.

Sharing is caring!

Documents

Looking for a Business Associate Agreement?

Download our free template to get started on your path toward HIPAA compliance.

Download Now

Let's keep in touch

Stay up to date on the latest HIPAA news, plus receive tons of free tools and info.

Navigating HIPAA Compliance in 2023

Watch the recording of this webinar to learn more about how you can become and stay HIPAA compliant!

Document

Related Posts

What is Access Control in terms of HIPAA?

What is Access Control in terms of HIPAA?

Access control, in terms of cybersecurity, refers to the practice of managing and regulating who can access specific resources, systems, or data within an organization's network or information...

Comparing HIPAA and NIST

Comparing HIPAA and NIST

In the ever-evolving landscape of data security and privacy, two key frameworks have emerged as significant players: HIPAA and NIST. Both emphasize the importance of safeguarding sensitive...

Save & Share Cart
Your Shopping Cart will be saved and you'll be given a link. You, or anyone with the link, can use it to retrieve your Cart at any time.
Back Save & Share Cart
Your Shopping Cart will be saved with Product pictures and information, and Cart Totals. Then send it to yourself, or a friend, with a link to retrieve it at any time.
Your cart email sent successfully :)