How to tackle an accidental HIPAA violation

Introduction

The Healthcare Insurance Portability and Accountability Act is a federal regulation that dictates compliance rules for healthcare practitioners. Having an in-depth understanding of how HIPAA impacts your work will enable you to avoid any potential breaches whilst simultaneously protecting your patients and your practice. Given the amount of sensitive information that is handled within the healthcare industry, patient confidentiality is of utmost importance. This means that the information that is shared between you and a patient needs to be handled sensitively, and any stored data requires protective safeguards. Unfortunately, HIPAA violations do occur (even accidentally), so you must know how to deal with these situations should they happen. In this guide, we’ll outline the differences between an accidental and an incidental violation before highlighting the steps you should take to ensure you manage the breach ethically and professionally.

What is an accidental HIPAA violation?

An accidental HIPAA violation refers to the unauthorized disclosure of PHI (protected health information) without intent. Despite having safeguards and protective measures in place, there is still a possibility of breaching HIPAA regulations. These types of violations could include an employee accidentally seeing a different patient’s medical records, an email being sent to the wrong person or the loss or theft of a personal device that contains PHI. Although each of these violations is accidental, the involved individual or practice will still have to bear the responsibility for the unauthorized disclosure of PHI. Consequences for accidental violations vary depending on circumstances, but it is highly likely to incur fines and occasionally even the loss of a medical license. Everyone is human, and everyone makes mistakes, but being vigilant about the way you treat PHI will help to minimize the risk of accidental violations and ensure your patients remain protected. 

Incidental HIPAA violations vs Accidental HIPAA violations

Incidental HIPAA violations refer to the incidental disclosure of PHI. The main difference between these and accidental HIPAA violations is the presence of adequate safeguards protecting PHI. HIPAA recognizes that there are some unavoidable circumstances wherein PHI may be incidentally disclosed. Depending on the context of these instances, they do not need to be reported. The HIPAA Privacy Rule essentially states that incidental disclosures of PHI are allowed when the Covered Entity has implemented compliance policies to the minimum necessary standard. Some commonly occurring examples of incidental HIPAA violations include:

• A patient sees the name or medical treatment information of another patient on a whiteboard at the healthcare clinic.
• A conversation between two providers or between a patient and a provider is overheard.

Whilst it is difficult to completely eradicate incidental disclosures, there are safeguards your practice can put in place to minimize their occurrence:

• Conversations between providers or with a patient that concerns PHI should be done in a private room or space. 
• Providers, receptionists, and other healthcare staff should only call out the first name of a patient to ensure their privacy is protected.

How should private practitioners that are covered respond to accidental HIPAA violations

Although nobody likes to think about the possibility of a HIPAA violation, you must know how to deal with them if they do occur. In relation to an accidental violation, three main steps should be taken immediately to ensure your response is prompt and professional: investigate the violation, complete a risk assessment and implement relevant further training if necessary.

As soon as an accidental violation occurs, it is the responsibility of the involved staff member to report it to the HIPAA officer. From there, the officer will conduct a risk assessment into the manner of the violation to determine the next steps. Risk assessments can differ slightly depending on the violation, but they typically involve acquiring the following information: 

1. The nature of the breach
2. What type of information is involved in violation
3. Which patients are impacted
4. To whom is the information disclosed
5. Chances of the information being re-disclosed
6. The extent to which the risk has been avoided

After conducting a risk assessment, it will be decided whether or not the breach needs to be reported. Certain violations are exempt, and these are usually breached wherein a staff member was acting in good faith and immediately attempts to rectify their mistake. Additionally, after an accidental HIPAA violation has occurred, the business associate is required to report the details of the incident to the covered entity within 60 days. 

Depending on the nature of the accidental HIPAA violation and what it entailed, the healthcare practice may deem it necessary to implement policies and protocols to help maintain compliance. This could include a training session for all staff, reinforcing good communication, or updating the software that is in place. Although every healthcare business should aim to minimize the risk of HIPAA violations, it is nevertheless important to have a good understanding of the procedures that follow from an accidental breach. Knowing this information will allow you to keep the damage from the violation to a minimum and protect both yourself and your patients.

How should employees respond to accidental HIPAA violations

It is a requirement regulated by HIPAA that every healthcare business has a HIPAA officer. When an accidental violation occurs, the involved staff member needs to immediately notify the HIPAA officer of the details relating to the breach. This process only works effectively if every staff member (both clinical and administrative) has a thorough understanding of HIPAA regulations and how breaches can occur. In order to ensure that compliance is maintained as effectively as possible, it is a good idea to implement regular HIPAA training programs within healthcare practices. This way, staff members will not only be able to minimize the risk of a breach occurring, but they will also know what to do in the unfortunate event of a violation. After the breach has been reported by the staff member to the HIPAA officer, it is then the officer’s role to investigate the nature of the breach. As we mentioned earlier, this entails a risk assessment that will consequently determine whether or not the violation needs to be reported to the Department of Health and Human Services Office for Civil Rights for further investigation. 

What are some examples of accidental HIPAA violations?

When it comes to HIPAA violations, it is very important to understand the difference between accidental and intentional breaches. Whilst these may sound quite self-explanatory, having a few examples of common accidental HIPAA violations will help you to solidify this knowledge: 

1. A healthcare physician accidentally accesses the medical records of a patient that they aren’t authorized to see. After noticing they are viewing the wrong files, they immediately exit the database. 
2. A healthcare worker is discussing a patient’s medical treatment intervention and/or progress with another of the patient’s providers. This conversation is overheard by another staff member who informs them, and they move to a more discreet location. 
3. A physician downloads PHI onto a USB flash drive, which is then stolen. Although the individual didn’t mean to lose the device, it is a foreseeable incident that could have been prevented using certain measures so is still considered a HIPAA violation. 
4. A healthcare business sent X-ray files to an external company to be digitized. However, there was no BAA (business associate agreement) between the two companies, making it a HIPAA violation. 
5. A healthcare provider spoke to their patient about the results of a recent medical test within the earshot of other patients. 

Although all of these are examples of accidental HIPAA violations, they vary in their degree of seriousness. Depending on the intent of and damage caused by the breach, consequences may vary between implementing renewed HIPAA training, incurring a fine, or even losing your job.

Common FAQs around HIPAA violations

As I’m sure you can tell, HIPAA violations are complicated. Regulations are constantly changing and new protocols are frequently introduced. To help you consolidate your knowledge, we’ve included a list of some of the most common FAQs:

When does an accidental HIPAA violation need to be reported to the Department of Health and Human Services Office for Civil Rights? 

When an accidental HIPAA violation occurs, it needs to be reported to the OCR only when there is an unauthorized disclosure of PHI. If there is no breach of PHI, then the violation does not need to be reported to the OCR. 

What happens if you don’t report an accidental HIPAA breach to the HIPAA officer? 

If you fail to report a HIPAA breach, even if it is accidental, you risk incurring a significant fine or serious penalty. Even if the breach occurred entirely without intent, it is still required that the relevant individual reports it immediately. 

What is the “burden of proof” that is in the Breach Notification Rule? 

The burden of proof details that Covered Entities and Business Associates can only choose not to report a breach if they can prove there was a very minimal likelihood of PHI being compromised.

Is a HIPAA violation grounds for termination? 

Whilst wilful HIPAA violations are grounds for termination, in the case of accidental breaches termination is decided by the employer. Depending on the damage and scope of the breach, an internal investigation may result in consequences that vary from termination to the implementation of enhanced compliance training. 

Conclusion

HIPAA compliance is an essential component of working in the healthcare industry. Whilst having a good understanding of the relevant regulations can be complicated, it is imperative if you want to protect both yourself and your patients. In recent years, technology has been developed that can assist healthcare practices in effectively maintaining compliance. Carepatron offers sophisticated software that can safeguard PHI, implement authorization and password controls and ensure clinical documentation is protected at all times. Additionally, Carepatron provides a secure platform from which patients can access their medical records, appointment times, and payment details, information that is required by HIPAA to be accessible. Regardless of the preventative measures that you have in place at your healthcare business, the possibility of an accidental HIPAA violation occurring is still quite high. To ensure these happen as infrequently as possible, we highly recommend looking into systems like Carepatron, so you can feel confident in your ability to maintain compliance and protect both yourself and your patients.