My last post focused on the discovery and investigation of a data security breach to determine if breach notification is needed. Today’s post now turns to the requirements of breach notification triggered by a data security breach.

Notification to Individual Patients

When a breach is discovered and a covered entity (CE) determines that unsecured ePHI has been compromised, that entity must notify all individuals whose information was affected by the breach without unreasonable delay, defined as within 60 calendar days from discovery of the breach. Discovery is legally defined as having occurred on the first day the breach is known or should have known. This definition means that the clock begins running from the moment the breach is or should have been discovered. This requirement means that an investigation must be conducted quickly and efficiently after discovery of the incident, so that determination of the necessity of notification occurs quickly and breach notification, if necessary, is timely.

If breach notification is required, the patient notice of the security breach should contain the following:

• a description of what happened (the breach incident),

• the types of unsecured ePHI involved,

• steps patients should take to protect themselves,

• a description of the actions taken by the CE to investigate and mitigate the effects of the breach,

• the actions taking to prevent future breaches, and

• information about how to contact the CE about the breach.

In addition, the breach notification should be written in plain language that the average patient can understand.

This notice must then be mailed via first-class mail to the last-known address of the individual or by email, if the individual has agreed to receive notice in that manner. However, a substitute notice must be used, where the CE has insufficient or out-of-date contact information for more than 10 of the individuals. In this case, the CE must post a conspicuous breach notification on its website for 90 days or in the local media in the area affected by the breach as well as provide a toll-free number for phone calls.

Notification of the HHS Secretary

A CE must also inform the Secretary of HHS, when a breach occurs that triggers notification provisions. If the breach affects less than 500 people, the CE can log the breach and present it with all other breaches in an annual report within 60 days of the end of the calendar year.

If more than 500 people are affected, the notice must be contemporaneous with the other required notices. In other words, a large data breach requires more immediate reporting to HHS.

Notification to the Media

When more than 500 residents of a state or jurisdiction are affected by the breach, the covered entity must notify all “prominent media outlets serving the State or jurisdiction." This option is not pleasant and can seriously damage a CE’s reputation. As a result, CEs need to be vigilant in monitoring and strengthening its security systems to prevent large data breaches. The bad press and financial consequences that a media publication may bring is incentive to review compliance with the Security and Privacy rules and take further steps to encrypt all ePHI.

Duties of Business Associations

Business Associates (BA) have similar timelines in terms of notification, but a BA is only required to notify the CE. HHS commentary to the regulations states, however, that if the BA is acting as an agent of a covered entity, the BA’s discovery of a breach will then be imputed to the CE itself, starting the notification countdown, not when the CE receives notice of the breach, but when the BA discovers it. This is a particularly troubling result, as a BA that delays in reporting a breach to a CE could significantly shorten the 60 days window for a CE to notify affected individuals.

CEs and BAs should continually monitor and reevaluate their security systems that store, transmit, use PHI, in light of modern security standards and data breaches. As has been shown by the data breaches at Anthem, Target and Sony, no entity can be too careful in the protection of client data.