Tuesday, March 8, 2016

Share Your Opinion - Is This a HIPAA Breach or Merely an Accidental or Incidental Disclosure?

Emails Exposed BJC HealthCare Patients’ Data

What is the difference between an Incidental and an Accidental disclosure of protected health information (PHI) or a HIPAA Data Breach? Can you give examples of each? How do you handle each in your practice for an accounting of disclosures as required in the HIPAA privacy rule regulations?

The difference between an "incidental" and an "accidental" disclosure of PHI is the difference between complying with the privacy rule and violating it.
In a recent story, BJC HealthCare, a not-for-profit health system based in St. Louis, MO., has started notifying 2,393 of its patients that some of their protected health information has been exposed as a result of an email error that occurred on December 30, 2015.

An email containing sensitive data covered by HIPAA was emailed to another medical group. While HIPAA permits the sharing of healthcare data for certain healthcare operations, the Security Rule requires any shared data to be protected in transit.

If ePHI is to be shared electronically with another covered entity or business associate, it must be adequately protected to prevent unauthorized access and to protect the integrity of those data. Controls to protect the integrity of ePHI are addressable issued under 45 CFR § 164.312(e).

In this case, the data were not encrypted to the standards required by the Security Rule, and consequently the data could potentially have been intercepted in transit.

HIPAA requires covered entities to notify individuals when their PHI has been exposed or viewed by a third party to allow them to take precautions to protect their identities and reduce the risk of loss or harm.

Patients have been advised by mail that their name, date of birth, gender, and Medicare Beneficiary information were included in the email, although Social Security numbers were not exposed, and no financial or medical data were contained in the email. Patients affected by the email error were part of the healthcare provider’s accountable care organization.

An investigation into the incident showed that the email was received by the intended recipient and no other individual appeared to have gained access to any patient data, although the possibility cannot be ruled out. Out of an abundance of caution, all affected individuals have been offered complimentary credit monitoring services for a period of one year.

In order to prevent similar errors from occurring in the future, BJO HealthCare will be conducting further staff training to ensure that staff members are aware of the protocols that must be followed when transmitting data covered by HIPAA.


So with all information considered, would you say this incident is a Data Breach, an Accidental disclosure or an Incidental disclosure?  Please post a comment with your feedback.

Additional Information:

Certain "incidental" disclosures are a permitted use of PHI and, therefore, are not a violation of the regulations. (See Section 164.502(a)(1)(iii).) On the other hand, an "accidental" disclosure is not permitted under the regulations and would subject the organization to penalties for the violation. (See Section 164.502(a)(1) and (2) of the regulations.) The HIPAA statute would limit the penalties for an accidental disclosure to civil penalties alone. 

An "incidental" use and disclosure occurs as a by-product of another permissible or required use or disclosure under the privacy rule. It is a limited disclosure that cannot reasonably be prevented.   Examples of "incidental" disclosures include a hospital visitor overhearing a provider's confidential conversation with another provider or a patient, or a visitor catching a glimpse of a patient's information on a sign-in sheet or nursing station whiteboard.

An incidental use or disclosure may result from any use or disclosure permitted under the privacy rule. It is not limited to treatment communications or to communications among healthcare providers or other medical staff. An incidental use or disclosure may occur, for example, when a provider talks with an administrative staff member about billing a patient for a particular procedure and is overheard by 1 or more persons in the waiting room. 

An incidental use or disclosure is not a violation of the HIPAA medical privacy regulation provided the covered entity has applied reasonable safeguards (see Section 164.530(c) of the regulation) and implemented the minimum necessary standard (see Sections 164.502(b) and 164.514(d) of the regulation), where applicable, with respect to the underlying use or disclosure. (See Section 164.502(a)(1)(iii) of the regulation). If the underlying use or disclosure violates the privacy rule, however, the incidental use or disclosure would be a violation of the rule. 

Incidental disclosures do not have to be included in the accounting of disclosures provided at the patient's request. (See Section 164.528(a)(1)(iii) of the regulation.) 

Source(s): www.hipaajournal.comwww.medscape.com, www.law.cornell.edu, hhs.gov

To subscribe to this blog, enter your email address:

Delivered by FeedBurner


  1. Defiantly a HIPPA breach in that the information was not properly encrypted to ensure it was not able to be read during transport.

  2. LifeVoxel.AI has developed a Interactive Streaming and AI Platform for medical imaging using GPU clusters cloud computing. It is a leap in cloud technology platform in medical imaging that encompasses use cases in visualization, AI, image management and workflow. It’s approach is unique that it has been granted 12 International patents.

    Interactive Streaming AI Platform RIS PACS

  3. Violating HIPAA standards can result in heavy fines, based on the level of negligence.
    Contact RSI Security for HIPAA Compliance and avoid heavy fines and damage to business reputation.
    RSI Security helps you meet HIPAA compliance requirements.

  4. LifeVoxel.AI platform helps imaging diagnostic centers and hospitals to save up to 50%+ over conventional RIS PACS with higher functionality. LifeVoxel.AI is the fastest RIS PACS available globally and have unimaginable capabilities of centralized PACS across all your network of Imaging Centers to single window HUB.

    RIS PACS software

  5. Perfect Data Entry is one of the companies in the world's leading outsourcing companies. It's prepared to deal with the entirety of your organization's backend needs. No activity is excessively little or enormous for us. Visit the Perfect data entry official site to know more about hippa data entry

  6. I was wondering what you guys think about possible upcoming data solutions to accidental HIPPA violations? I’ve come across a few data companies that are actively involved in trying to make the best data security solutions to keep HIPPA compliant. Some of the most interesting at the moment have been infoVia, DataRebels, and Data Vault. It’s a bit over my head to explain, but it seems there’s a growing movement to both ‘free-up’ a company’s data, like the way they share it throughout the organization while protecting it very closely. it’s been a really interesting conversation going on, one I think businesses like hospitals and insurance groups need to have. One of the most helpful breakdowns of these I could find is infoVia’s that I wanted to share and have your thoughts on. Do you guys think it’s got some legs to it? https://info-via.com/infosecur/

  7. here is the link I meant to hyperlink

  8. Hello Am From The UK , I want to write a little testimony about the good work of doctor Oyagu who cured me from Hsv 1 and 2 for just 2 weeks with his herbal medicine, I never believe I can be normal again and have a good life like others I always regretted the day I got diagnose with the virus, I was lost of hope when my doctor told me there is no cure for it but I keep thinking and thinking about my future, if I can have kids of my own well I am so grateful for my helper who get me cured with his herbal medicine, I go online in search of anything that can help me because I can’t deal with it forever so I found this doc Oyagu email on a blog of someone who was cured by him I quickly contact him for help and explain all my pain to him, he told me not to worry about it there is cure for real, I never believe until he send me the herbal medicine when I order for it and I have it within 4 days that is how I took the medicine for 2 week and the following week I go for test just to confirm I was 100% cured from this sickness what a miracle in my life I am so happy right now, you can also get in contact with him if you have such sickness through email address oyaguherbalhome@gmail.com or text him on what's app, phone number +2348101755322 or visit his website https://oyaguspellcaster.wixsite.com/oyaguherbalhome Dr Oyagu also has remedy to others disease like COLD SORES,HIV/AIDS,DIABETES.CANCER,HIGH BLOOD PRESSURE AND MANY MORE. I oblige everyone to contact this powerful herbalist Dr Oyagu and be free from suffering.

  9. I want to use this opportunity to thank Dr Oyagu for the grate work he has done for me and my cousin sister, I was cured from herpes virus through his herbal remedy and my cousin sisters was also cured from Cancer. This is a grate testimony for what Dr Oyagu Has done for me and my entire generation. I’m giving this testimony so that those of you out there can contact him while he keeps saving my relatives. Send him a Dm and get a better health totally. Contact him via WhatsApp +2348101755322 or Email address:oyaguherbalhome@gmail.com you can also reach him on his website https://oyaguspellcaster.wixsite.com/oyaguherbalhome


    Asore Corp is a group of multinational Hacker's, an affiliate of Evil Corp. We make sure by all means necessary that our clients get the best of services on a��PAYMENT AFTER JOB IS DONE BASIS✅. Rather than send money and trust a criminal to fulfill your deal, you can make sure the job is done before WORKMANSHIP is paid for. You'll get excellent customer service.

    That's a 100% guarantee. Our Cyber security Technicians are on standby 24/7 to receive your job requests.

    ⚠️ BEWARE OF FRAUDSTARS looking to hoax.

    if you have been a VICTIM, contact : ✉️cyberprecinct@gmail.com for directives.

    Here, it's always a win for you.


    ➡️Binary Option funds recovery

    ➡️Social media hack

    ➡️Recovery of loan scam

    ➡️Credit repair (Equifax,Experian,Transunion)

    ➡️Email hack

    ➡️College score upgrade

    ➡️Android & iPhone Hack

    ➡️Website design

    ➡️Website hack

    And lots more.

    DISCLAIMER: Asore Cyber Corp accepts no responsibility for any information,previously given to anybody by clients on as regarding the job. Asore Cyber Corp will not distribute contact information collected on any hacking job other than in the Asore corps Hacker's listings themselves, and will not sell contact information to third parties.


    �� asorehackcorp@gmail.com


    Copyright ©️

    Asore Cyber Corp 2021.

    All rights reserved.

  11. Good news this is to everyone out there with different health challenges, as I know there are still a lot of people suffering from different health issues and are therefore looking for solutions. I bring you Good news. There is a man called Dr Ehimare a herbal practitioner who helped cured me from HSV (2). I have suffered from this disease for the past 5 years and I have spent so much money trying to survive from it. I got my healing by taking the herbal medicine Dr Ehimare sent to me to drink for about 14 days . 3 days after completion of the dosage, I went for a medical checkup and I was tested free from HSV. All thanks to God for leading me to Dr Ehimare who was able to cure me completely from this deadly disease. I’m sharing this so that other people can know of this great healer called Dr Ehimare   because I got to know him through Elizabeth who he cured from HIV. I was made to understand that he can cure several other deadly diseases and infections. Don’t die in ignorance or silence and don’t let that illness take your life. Contact Dr Ehimare   through his email  drehimare3@gmail.com or whatsapp on +1 (267) 691-1087   He cure all forms of disease {1}HIV/AIDS {2}DIABETES {3}EPILEPSY {4} BLOOD CANCER {5} HPV {6} BRAIN TUMOR {7} HEPATITIS {8}COPD{9} SICKLE AND ANAEMIA.etc Be kind enough to share as you received.