This week we had an interesting question come in. One of our clients was copied by a general agent in a response to an application for health insurance. This message contained ePHI that wasn’t encrypted. Was it a breach? What does that mean for the agents? Does the client need to be notified?
We passed this to David Smith for his thoughts, and here is his assessment:
I do not believe there was a breach for either agent in this situation.This is because the information that passed between the parties was between business associates, and therefore there is no requirement that agent that initiated the application notifies the client because this agency has done nothing to breach the HIPAA Privacy, Security or HITECH rules.
However, the general agency is clearly in violation of the HIPAA security requirements concerning encryption of ePHI. This is a very serious issue, and all PHI should be encrypted at rest, and in transit.
The general agency will need to document this violation, and will potentially need to sanction the offending agent. This could be a verbal warning, retraining, or suspension. While this was not malicious, it could still be a serious issue for the general agency. When issues like this arise, you need to act quickly to support your clients, and let people know when they have made mistakes. Remember, sanctions should be clearly notated in your Security Policies and Procedures, and it is important that you enforce them.
I do believe there is value in the initiating agency providing information to the client along the following lines:
- A company I do business with violated the HIPAA Security requirements related to transmission of electronic health information as a business associate of various health insurance carriers.
- They have assured me that this was a one-time mistake and that they have taken appropriate corrective action to prevent any future issue.
- I am letting you know because of the seriousness with which I am taking the responsibility of maintaining the privacy and security of my clients’ information and to assure you that I will remain diligent about any future issues on your behalf.
The key here is letting your clients know if and when there is an issue, so they can be proactive in monitoring their personal information.
By Jason Karn
Total HIPAA specializes in HIPAA compliance services, helping businesses adhere to HIPAA guidelines and protect sensitive data. Our experts ensure your organization remains compliant with HIPAA regulations, meaning you can focus on your core operations while we handle documenting the policies and procedures that make up your HIPAA compliance plan. Trust Total HIPAA for comprehensive compliance solutions tailored to your needs. Book a clarity call today.
