Looking for a Business Associate Agreement? Download our FREE starter template.
Total HIPAA Logo

Is it a breach, or not?

This week we had an interesting question come in. One of our clients was copied by a general agent in a response to an application for health insurance. This message contained ePHI that wasn’t encrypted. Was it a breach? What does that mean for the agents? Does the client need to be notified?

We passed this to David Smith for his thoughts, and here is his assessment:

I do not believe there was a breach for either agent in this situation.This is because the information that passed between the parties was between business associates, and therefore there is no requirement that agent that initiated the application notifies the client because this agency has done nothing to breach the HIPAA Privacy, Security or HITECH rules.

However, the general agency is clearly in violation of the HIPAA security requirements concerning encryption of ePHI. This is a very serious issue, and all PHI should be encrypted at rest, and in transit.

The general agency will need to document this violation, and will potentially need to sanction the offending agent. This could be a verbal warning, retraining, or suspension. While this was not malicious, it could still be a serious issue for the general agency. When issues like this arise, you need to act quickly to support your clients, and let people know when they have made mistakes. Remember, sanctions should be clearly notated in your Security Policies and Procedures, and it is important that you enforce them.

I do believe there is value in the initiating agency providing information to the client along the following lines:

  • A company I do business with violated the HIPAA Security requirements related to transmission of electronic health information as a business associate of various health insurance carriers.
  • They have assured me that this was a one-time mistake and that they have taken appropriate corrective action to prevent any future issue.
  • I am letting you know because of the seriousness with which I am taking the responsibility of maintaining the privacy and security of my clients’ information and to assure you that I will remain diligent about any future issues on your behalf.

The key here is letting your clients know if and when there is an issue, so they can be proactive in monitoring their personal information.

By Jason Karn

Google+

Sharing is caring!

Does your organization comply with HIPAA?

Find out if your organization needs to comply with HIPAA using our simple, fast, online questionnaire.

Start Questionnaire →

Save & Share Cart
Your Shopping Cart will be saved and you'll be given a link. You, or anyone with the link, can use it to retrieve your Cart at any time.
Back Save & Share Cart
Your Shopping Cart will be saved with Product pictures and information, and Cart Totals. Then send it to yourself, or a friend, with a link to retrieve it at any time.
Your cart email sent successfully :)

[el.selectedIndex]
[el.selectedIndex]
[fieldObj.selectedIndex]
[fieldObj.selectedIndex]
[el.selectedIndex]
[el.selectedIndex]
[fieldObj.selectedIndex]
[fieldObj.selectedIndex]
[el.selectedIndex]
[el.selectedIndex]
[fieldObj.selectedIndex]
[fieldObj.selectedIndex]