A disaster happened: your healthcare organization suffered a data breach and possible HIPAA violation.
HIPAA, or the U.S. Health Insurance Portability and Accountability Act of 1996, sets out the rules and regulations that protect the rights and privacy of patients. Covered entities (CEs) and business associates must follow the Act and its accompanying rules. But what happens if a breach occurs? What do you do after a HIPAA violation?
RELATED: Healthcare Data Breaches—A Haunting Reality
The U.S. Department of Health and Human Services’ ( HHS) HIPAA consists of five sections (or titles) that standardize patient protections. The HHS Office for Civil Rights ( OCR) regulates and enforces the Act.
RELATED: What is HIPAA? Or is it HIPPA?
Title II is key to our discussion as it sets the policies and procedures for safeguarding protected health information (PHI). Important sections include:
Understanding and implementing HIPAA rules is fundamental to patient care and avoiding potential HIPAA violations.
A HIPAA violation occurs when a CE does not properly safeguard patients’ PHI and suffers a data breach.
RELATED: The Complete Guide to HIPAA Violations Breaches can occur in a variety of ways, whether intentional or unintentional, due to negligence or an accident. It doesn’t matter whether or not a hacker demands a ransom or does anything with the stolen PHI.
RELATED: To Pay or to Not Pay for Stolen Data Throughout 2020, cyberattacks were a daily occurrence. In fact, the healthcare industry was heavily targeted, even more so because of the coronavirus pandemic. Moreover, our most recent monthly HIPPA Breach Report demonstrates that over 4 million patients were affected by breaches in December 2020. A HIPAA compliant CE fulfills HIPAA’s requirements and reduces the risk of a breach to an appropriate and acceptable level. While breaches happen easily nowadays, it is important to understand that a breach does not automatically mean a HIPAA violation.
Once discovered, how the CE reacts and the steps taken will help OCR decide if a HIPAA violation occurred. First, it is necessary to take immediate action, even if a CE only suspects a breach. The organization must conduct a risk assessment to determine what PHI was involved, its nature, and the extent of the breach. HIPAA mandates audit and risk assessments for this very reason. Moreover, the CE must contain the breach. This might mean cutting access to a system/network or suspending an affected employee’s account. This is why it is necessary to have contingency plans ready at any given moment. Depending on the results of the assessment, a CE may need to notify HHS, proper authorities, and any affected patients and include:
How you tell HHS also hinges on the extent of the breach. A breach that affects fewer than 500 patients means logging the incident with HHS within 60 days of the year’s end. A breach affecting greater than 500 patients means that HHS must be notified immediately. It should also be noted that breaches affecting over 500 individuals end up on what is known as OCR’s Wall of Shame. At this point, OCR will more than likely perform a compliance review, resolving the case only if the CE demonstrates voluntary compliance, corrective action, and/or a resolution agreementhttps://paubox.com/blog/what-is-hipaa-resolution-agreement/. Depending on the investigation, fines run from $100 to $1.5 million per violation along with potential jail time. The more neglect was a factor in the data breach, the larger the fine will be.
RELATED: Health Plan Fined $5.1 Million for Data Breach
And unfortunately, these fines are not the only costs due to a HIPAA violation. Costs associated with the mandatory corrective action plan (CAP) will more than likely be excessive. A CAP’s purpose is to find the underlying security issues within your organization and make you correct them. The timeline for a CAP can potentially last for several years. You will regularly report to the OCR on your progress and submit your organization to audits during this time.
Ideally, maintaining HIPAA compliance keeps CEs from dealing with a breach, HIPAA violation, and/or OCR fine and CAP. In fact, everything within a CAP should already be applied under HIPAA. To avoid a HIPAA violation, it is fundamental to use a strong cybersecurity program that a CE continuously tests and updates. Such safeguards should include:
RELATED: Avoid the Worst-Case Scenario with a Business Continuity Plan
Paubox Email Suite Plus provides the necessary email security you as a CE need to protect patients' electronic PHI (ePHI) transmitted via email. All messages are sent and received with NSA-recommended TLS email encryption 1.2 or 1.3, and our inbound security solutions stop harmful emails from even reaching an inbox. Avoid future problems by actively creating a cybersecurity program that works for you, starting with strong email security. Proactive HIPAA compliance is less expensive and less time consuming than dealing with a HIPAA violation.