HIPAA Breach Evaluation and Reporting - What Qualifies as a Reportable Breach and How to Report It

This training program will discuss the origin of the HIPAA Breach Notification Rule, how it works, including interactions with other HIPAA rules and penalties for violations. It will also explain how to create the right breach notification policy for your organization and best practices to follow through when an incident occurs.

Why Should You Attend:

The HIPAA Breach Notification Rule has been in effect since 2010 and has been significantly modified in 2013. Whenever there may be a privacy issue involving Protected Health Information, there may be a reportable breach under the HIPAA regulations. Not all privacy violations are reportable breaches, though, so it is essential to have a good process for evaluating incidents to see if they have resulted in a reportable breach. The training program will examine how to determine if a privacy violation is potentially a breach according to the definition, and then describe the subsequent steps in the evaluation, if it is determined that the definition has been met. It will discuss the exceptions to the breach definition for inadvertent internal uses, or when it can be determined that the information could not be retained in any way by the receiving party. Entities can avoid notification if information has been encrypted according to Federal standards. The instructor will cover the guidance from the US Department of Health and Human Services that shows how to encrypt so as to prevent the need for notification in the event of lost data. Failing that, a risk analysis can be conducted to determine the probability of compromise of the information, considering four factors: what the data is and how well identified it is, to whom was it released and do they have obligations to protect the information, whether or not the information actually exposed, and whether or not the incident has been mitigated properly. However, it must be noted that any compromise of the information by Ransomware that denies access or control of your information should be treated as a reportable breach.