Ask these questions in your harm threshold risk assessment
HIPAA Weekly Advisor, October 26, 2009
Want to receive articles like this one in your inbox? Subscribe to HIPAA Weekly Advisor!
HHS’ interim final rule on breach notification includes a “harm threshold” provision that provides covered entities (CEs) an avenue to avoid reporting a breach to HHS. If the incident involves encrypted data compliant with HHS guidelines or if a risk assessment shows that the disclosure does not pose a significant risk to the affected individual, there is no breach.
But CEs and business associates (BAs) must follow systematic steps to reach that “no harm, no foul” conclusion. They must document their findings and have them readily available if an auditor requests them. Facilities should always conduct an informal or formal risk assessment regardless of whether the disclosure appears innocent.
John C. Parmigiani, MS, BES, president of John C. Parmigiani & Associates, LLC, in Ellicott City, MD, says your risk assessment should answer the following questions:
- Who was involved? How many patients’ information was breached?
- Did the perpetrator copy the information, transfer it, change it, or simply look at it?
- When did it happen? (This is important because the 60-day breach reporting window to HHS starts when you first learn of it.)
- Is there a financial risk to the victim, a personal risk, or both?
- Was the motive for the breach nefarious or casual?
- Is the risk for further harm still there?
- What can the organization do right now to ensure no further damage occurs?
- What has the organization learned from the disclosure?
- How can the organization prevent this in the future?
Editor’s note: This is an excerpt from the November issue of Briefings on HIPAA, the 12-page HCPro, Inc. newsletter.
Want to receive articles like this one in your inbox? Subscribe to HIPAA Weekly Advisor!
Related Products
-
Guide to HIPAA Auditing, Second Edition
This new edition of a best-selling book delivers the hands-on tools and guidance you need to conduct effective in-house...
-
HIPAA Training Handbook for Business Associates
Train all of your staff members with this handbook and others in the 2009 HIPAA Handbook Series. Ensure they understand...
-
HIPAA Handbook for Executive, Administrative and Corporate Staff
Train all of your staff members with this handbook and others in the 2009 HIPAA Handbook Series. Ensure they understand...
-
The No-Hassle Guide to HIPAA Policies: A Privacy and Security Toolkit
HIPAA regulations require extensive documentation—likely more than you've done in the past. Changing the way you look...
-
The HIPAA and HITECH Toolkit
The HIPAA and HITECH Toolkit is a valuable resource that helps both CEs and BAs understand and meet the HITECH Act's...
Most Popular
- Articles
-
- HIPAA Q&A: Flu shot requirement for hospital employees
- HealthDataInsights posts new issues for medical necessity claims
- Running an effective peer review committee meeting
- Q&A: Incidental disclosures and patient privacy
- New FAQ posted on storing laryngoscope blades
- Sneak Peek: Effort underway to establish caseload benchmarks
- Tip: Perform your own internal investigation prior to government audit
- What does case-mix index mean to you?
- HIPAA 5010 deadline extended, but threat remains, says AMA
- HHS task force: Consider privacy, security with text messages
- E-mailed
-
- Running an effective peer review committee meeting
- HIPAA Q&A: Flu shot requirement for hospital employees
- What does case-mix index mean to you?
- Featured blog post: Nurses face felony charges after reporting physician to the Texas Medical Board
- HHS task force: Consider privacy, security with text messages
- Tip: Correctly code bilateral pain management procedures
- 2012 CPT code changes for ASCs: Shoulder and knee scopes and pain management
- COT basics to best
- Documentation and coding for toxic metabolic encephalopathy
- Guidance and tact key to compliant, effective physician queries
- Searched