Tuesday, March 8, 2016

Share Your Opinion - Is This a HIPAA Breach or Merely an Accidental or Incidental Disclosure?

Emails Exposed BJC HealthCare Patients’ Data

What is the difference between an Incidental and an Accidental disclosure of protected health information (PHI) or a HIPAA Data Breach? Can you give examples of each? How do you handle each in your practice for an accounting of disclosures as required in the HIPAA privacy rule regulations?

The difference between an "incidental" and an "accidental" disclosure of PHI is the difference between complying with the privacy rule and violating it.
In a recent story, BJC HealthCare, a not-for-profit health system based in St. Louis, MO., has started notifying 2,393 of its patients that some of their protected health information has been exposed as a result of an email error that occurred on December 30, 2015.

An email containing sensitive data covered by HIPAA was emailed to another medical group. While HIPAA permits the sharing of healthcare data for certain healthcare operations, the Security Rule requires any shared data to be protected in transit.

If ePHI is to be shared electronically with another covered entity or business associate, it must be adequately protected to prevent unauthorized access and to protect the integrity of those data. Controls to protect the integrity of ePHI are addressable issued under 45 CFR § 164.312(e).

In this case, the data were not encrypted to the standards required by the Security Rule, and consequently the data could potentially have been intercepted in transit.

HIPAA requires covered entities to notify individuals when their PHI has been exposed or viewed by a third party to allow them to take precautions to protect their identities and reduce the risk of loss or harm.

Patients have been advised by mail that their name, date of birth, gender, and Medicare Beneficiary information were included in the email, although Social Security numbers were not exposed, and no financial or medical data were contained in the email. Patients affected by the email error were part of the healthcare provider’s accountable care organization.

An investigation into the incident showed that the email was received by the intended recipient and no other individual appeared to have gained access to any patient data, although the possibility cannot be ruled out. Out of an abundance of caution, all affected individuals have been offered complimentary credit monitoring services for a period of one year.

In order to prevent similar errors from occurring in the future, BJO HealthCare will be conducting further staff training to ensure that staff members are aware of the protocols that must be followed when transmitting data covered by HIPAA.

---

So with all information considered, would you say this incident is a Data Breach, an Accidental disclosure or an Incidental disclosure?  Please post a comment with your feedback.

Additional Information:

Certain "incidental" disclosures are a permitted use of PHI and, therefore, are not a violation of the regulations. (See Section 164.502(a)(1)(iii).) On the other hand, an "accidental" disclosure is not permitted under the regulations and would subject the organization to penalties for the violation. (See Section 164.502(a)(1) and (2) of the regulations.) The HIPAA statute would limit the penalties for an accidental disclosure to civil penalties alone. 


An "incidental" use and disclosure occurs as a by-product of another permissible or required use or disclosure under the privacy rule. It is a limited disclosure that cannot reasonably be prevented.   Examples of "incidental" disclosures include a hospital visitor overhearing a provider's confidential conversation with another provider or a patient, or a visitor catching a glimpse of a patient's information on a sign-in sheet or nursing station whiteboard.


An incidental use or disclosure may result from any use or disclosure permitted under the privacy rule. It is not limited to treatment communications or to communications among healthcare providers or other medical staff. An incidental use or disclosure may occur, for example, when a provider talks with an administrative staff member about billing a patient for a particular procedure and is overheard by 1 or more persons in the waiting room. 


An incidental use or disclosure is not a violation of the HIPAA medical privacy regulation provided the covered entity has applied reasonable safeguards (see Section 164.530(c) of the regulation) and implemented the minimum necessary standard (see Sections 164.502(b) and 164.514(d) of the regulation), where applicable, with respect to the underlying use or disclosure. (See Section 164.502(a)(1)(iii) of the regulation). If the underlying use or disclosure violates the privacy rule, however, the incidental use or disclosure would be a violation of the rule. 


Incidental disclosures do not have to be included in the accounting of disclosures provided at the patient's request. (See Section 164.528(a)(1)(iii) of the regulation.) 

Source(s): www.hipaajournal.comwww.medscape.com, www.law.cornell.edu, hhs.gov

To subscribe to this blog, enter your email address:


Delivered by FeedBurner

10 comments:

  1. Defiantly a HIPPA breach in that the information was not properly encrypted to ensure it was not able to be read during transport.

    ReplyDelete
  2. Violating HIPAA standards can result in heavy fines, based on the level of negligence.
    Contact RSI Security for HIPAA Compliance and avoid heavy fines and damage to business reputation.
    RSI Security helps you meet HIPAA compliance requirements.

    ReplyDelete
  3. Perfect Data Entry is one of the companies in the world's leading outsourcing companies. It's prepared to deal with the entirety of your organization's backend needs. No activity is excessively little or enormous for us. Visit the Perfect data entry official site to know more about hippa data entry

    ReplyDelete
  4. I was wondering what you guys think about possible upcoming data solutions to accidental HIPPA violations? I’ve come across a few data companies that are actively involved in trying to make the best data security solutions to keep HIPPA compliant. Some of the most interesting at the moment have been infoVia, DataRebels, and Data Vault. It’s a bit over my head to explain, but it seems there’s a growing movement to both ‘free-up’ a company’s data, like the way they share it throughout the organization while protecting it very closely. it’s been a really interesting conversation going on, one I think businesses like hospitals and insurance groups need to have. One of the most helpful breakdowns of these I could find is infoVia’s that I wanted to share and have your thoughts on. Do you guys think it’s got some legs to it? https://info-via.com/infosecur/

    ReplyDelete
  5. HAVE YOU LOST YOUR MONEY TO BINARY OPTION SCAM OR ANY ONLINE SCAM WHATSOEVER?.DO YOUR DESIRE CREDIT REPAIR[EQUIFAX, EXPERIAN, TRANSUNION? WELL, YOU HAVE FOUND REDEMPTION IN ASORE CORP.



    Asore Corp is a group of multinational Hacker's, an affiliate of Evil Corp. We make sure by all means necessary that our clients get the best of services on a��PAYMENT AFTER JOB IS DONE BASIS✅. Rather than send money and trust a criminal to fulfill your deal, you can make sure the job is done before WORKMANSHIP is paid for. You'll get excellent customer service.

    That's a 100% guarantee. Our Cyber security Technicians are on standby 24/7 to receive your job requests.



    ⚠️ BEWARE OF FRAUDSTARS looking to hoax.

    if you have been a VICTIM, contact : ✉️cyberprecinct@gmail.com for directives.

    Here, it's always a win for you.



    ��OUR SERVICES��

    ➡️Binary Option funds recovery

    ➡️Social media hack

    ➡️Recovery of loan scam

    ➡️Credit repair (Equifax,Experian,Transunion)

    ➡️Email hack

    ➡️College score upgrade

    ➡️Android & iPhone Hack

    ➡️Website design

    ➡️Website hack

    And lots more.



    DISCLAIMER: Asore Cyber Corp accepts no responsibility for any information,previously given to anybody by clients on as regarding the job. Asore Cyber Corp will not distribute contact information collected on any hacking job other than in the Asore corps Hacker's listings themselves, and will not sell contact information to third parties.



    CONTACT INFO:

    �� asorehackcorp@gmail.com

    cyberprecinct@gmail.com



    Copyright ©️

    Asore Cyber Corp 2021.

    All rights reserved.

    ReplyDelete
  6. Good news this is to everyone out there with different health challenges, as I know there are still a lot of people suffering from different health issues and are therefore looking for solutions. I bring you Good news. There is a man called Dr Ehimare a herbal practitioner who helped cured me from HSV (2). I have suffered from this disease for the past 5 years and I have spent so much money trying to survive from it. I got my healing by taking the herbal medicine Dr Ehimare sent to me to drink for about 14 days . 3 days after completion of the dosage, I went for a medical checkup and I was tested free from HSV. All thanks to God for leading me to Dr Ehimare who was able to cure me completely from this deadly disease. I’m sharing this so that other people can know of this great healer called Dr Ehimare   because I got to know him through Elizabeth who he cured from HIV. I was made to understand that he can cure several other deadly diseases and infections. Don’t die in ignorance or silence and don’t let that illness take your life. Contact Dr Ehimare   through his email  drehimare3@gmail.com or whatsapp on +1 (267) 691-1087   He cure all forms of disease {1}HIV/AIDS {2}DIABETES {3}EPILEPSY {4} BLOOD CANCER {5} HPV {6} BRAIN TUMOR {7} HEPATITIS {8}COPD{9} SICKLE AND ANAEMIA.etc Be kind enough to share as you received.  

    ReplyDelete
  7. Hello everyone my name is Martha and am here to tell u how i recover my Cryptocurrencies And Stolen Bitcoin. After falling victim to a cryptocurrency investment scam, I was left with nothing after these swindlers stole $139,060 in USDT and Bitcoins from me. I was so lucky to come across a post about Recovery my lost coins, a cryptocurrency and funds recovery Hackers with plenty of experience in cybersecurity. {MAX VIRUS} was able to recover all of MY funds, and with the information we provided, they were tracked down and reported to the appropriate authorities. I highly recommend {MAX VIRUS} for your cryptocurrency recovery.
    l will always recommend {MAX VIRUS}…Contact them with the following below

    Maxvirus@cyber-wizard.com
    Via WhatsApp +1 (941) 960-9892

    ReplyDelete
  8. Btc Recovery experts RECOVERY MASTERS//Secure Restoring Recovery
    Greetings, I am Lena Gwinn  a  Dermatologist from Poland and a Professional crypto//btc trader.I happened to be a scam victim After being swindled off 2,09 Btc by internet fraudsters from my CoinBase wallet who transferred them to unauthorised wallet.While trying to convince them to get it back they were instead insisting me to  invest more.I was almost giving up, when I came across a tweet from Mousa said from Bahrain on how he was able to recover his lost Usdt with the help of a group of specialised professional hackers RECOVERY MASTERS.I immediately Contacted them through their email (Recoverymasters@email.cz ) Even though they were only able to retrieve 90% of my bitcoin, I’m nevertheless happy because I didn’t think it would be possible.In Case you need such services you can reach them also through Whaptsap; +1(204)819-5505. I will forever be grateful to them.

    ReplyDelete
  9. I couldn’t resist the offer when it came up to me and that was how I ended up becoming another victim of a cryptocurrency trading scam, I had taken out loans to invest in this platform and I lost a capital of $457,000 to these scammers. It was unbearable and I thought of giving up my life when a colleague told me about Astraweb, I was dumbfounded when ASTRAWEB cyber was able to recover my money after I provided them with all the necessary information. Truly a remarkable cryptocurrency recovery company, I never thought it could be possible to recover your crypto once it is gone but Astraweb made it happen. I’m grateful for their selfless service and wish others like me would seek more knowledge before investing in crypto. If you ever want to recover your cryptocurrency too, you can find their contact information below.

    E-MAIL: AstraWeb@Cyberdude(.)com

    ReplyDelete