Reporting of HIPAA Incidents and Notifications in the Case of Breaches of Unsecured Protected Health Information

Layout for printing

Policy Number:

UW-131

Old Policy Number:

8.8

Responsible Office:

Office of Compliance

University Policy

Rationale/​Purpose:

In enacting HIPAA, Congress mandated the establishment of federal standards for the privacy of individually identifiable health information. Under the patchwork of laws existing prior to adoption of HIPAA and the Privacy Rule, personal health information could be distributed—without either notice or authorization—for reasons that had nothing to do with a patient's medical treatment or health care reimbursement. For example, unless otherwise forbidden by state or local law, without the Privacy Rule patient information held by a health plan could, without the patient’s permission, be passed on to a lender who could then deny the patient's application for a home mortgage or a credit card, or to an employer who could use it in personnel decisions. The Privacy Rule establishes a federal floor of safeguards to protect the confidentiality of medical information. State laws that provide stronger privacy protections apply over and above the federal privacy standards.

Definitions:

Breach

The acquisition, access, use, or disclosure of protected health information (PHI) in a manner not permitted under the HIPAA Privacy Rule which compromises the security or privacy of the information; any such acquisition, access, use, or disclosure is presumed to be a breach unless the covered entity or business associate, as applicable, demonstrates that there is a low probability that the protected health information has been compromised based on a risk assessment of at least the following factors:

1. The nature and extent of the protected health information involved, including the types of identifiers and likelihood of re-identification.
2. The unauthorized person who used the protected health information or to whom the disclosure was made.
3. Whether the protected health information was actually acquired or viewed.
4. The extent to which the risk to the protected health information has been mitigated.

Breach excludes:

1. Any unintentional acquisition, access, or use of protected health information by a workforce member or person acting under the authority of a covered entity or a business associate, if such acquisition, access, or use was made in good faith and within the scope of that person’s authority and does not result in further use or disclosure in a manner not permitted under the HIPAA Privacy Rule.
2. Any inadvertent disclosure by a person who is authorized to access protected health information at a covered entity or business associate to another person authorized to access protected health information at the same covered entity or business associate, or organized health care arrangement in which the covered entity participates, and the information received as a result of such disclosure is not further used or disclosed in a manner not permitted under the HIPAA Privacy Rule.
3. A disclosure of protected health information where a covered entity or business associate has a good faith belief that an unauthorized person to whom the disclosure was made would not reasonably have been able to retain such information.

Disclosure

The release, transfer, provision of, access to, or divulging in any manner of protected health information by an individual within the UW–Madison health care component (UW HCC) or the University of Wisconsin affiliated covered entity (UW ACE) with a person or entity outside the UW HCC or UW ACE.

Discovery

The first day on which an incident is known to UW–Madison (including by any person, other than the individual committing the breach, that is an employee, officer, or another agent of UW–Madison) or should reasonably have been known to UW–Madison to have occurred.

Protected health information (PHI)

Individually identifiable health information or health care payment information, including demographic information collected from an individual, which identifies the individual or can be used to identify the individual. Protected health information does not include student records held by educational institutions or employment records held by employers.

University of Wisconsin affiliated covered entity (UW ACE)

The UW–Madison health care component (except University Health Services and the State Laboratory of Hygiene), the University of Wisconsin Medical Foundation, and the University of Wisconsin Hospital and Clinics. See UW-101 Designation of UW Affiliated Covered Entity.

Unsecured PHI

Protected health information that is not rendered unusable, unreadable, or indecipherable to unauthorized persons through the use of a technology or methodology specified by the Department of Health and Human Services.

UW–Madison health care component (UW HCC)

Those units of UW–Madison that have been designated by the university as part of its health care component under HIPAA. See UW-100 Designation of UW–Madison Health Care Component for a listing of these units.

Scope:

Applies to all members of the UW HCC.

Policy:

Policy Summary

The Health Information Technology for Economic and Clinical Health Act regulations (HITECH) amended the Health Information Portability and Accountability Act (HIPAA) to establish requirements for notifying individuals in the event of a breach (as defined by HIPAA) of their unsecured protected health information. In addition, HITECH contains requirements for notifying the Office of Civil Rights (OCR) regarding breaches.

UW–Madison investigates potential breaches of protected health information (referred to hereafter as “incidents”) and determines if any incident meets HIPAA’s definition of a breach, therefore requiring breach notification according to HITECH. UW–Madison makes notifications in the manner required by HITECH.

Policy Detail

1. Investigations of Incidents (Paper or Oral Only).

   1. Anyone who becomes aware of an incident involving paper records or oral statements only must report the incident to the UW–Madison HIPAA privacy Officer within 24 hours of the discovery of the incident.

      HIPAA incident reports should be submitted online via the reporting mechanism available at compliance.wisc.edu/hipaa.

   2. Examples of incidents involving paper records or oral statements only include:
      1. A patient is handed a copy of the wrong After-Visit Summary.
      2. A health care provider is overheard discussing a patient’s identifiable medical information in the elevator or cafeteria.
      3. An abstract or poster for a presentation at an event or conference contains PHI and does not reference obtaining appropriate authorization.
      4. Postcards are mailed to patients or research subjects which name diagnoses or specific therapies in addition to full names and addresses.
   3. To the extent applicable, the HIPAA privacy officer will notify the HIPAA privacy coordinator of the applicable UW HCC unit within 24 hours of being notified of an incident.
   4. The HIPAA privacy officer will lead the investigation and, in coordination with the HIPAA privacy coordinator of the applicable UW HCC unit or their designee, will complete the UW–Madison HIPAA Breach Analysis Form as soon as practicably possible, absent exigent circumstances. The HIPAA privacy officer will notify the HIPAA Privacy and Security Operations Committee of the investigation and, if an investigation appears likely to continue beyond 14 calendar days, will also provide the reason for the delay.
   5. The HIPAA privacy officer will maintain a log of all reported incidents along with information from the HIPAA Breach Analysis Form and information about any notices sent to affected individuals, media outlets, and the Office of Civil Rights of the Department of Health and Human Services.
2. All Other Investigations of Incidents.

   1. Anyone who becomes aware of an incident other than those described in I. above must report the incident to the HIPAA privacy officer or the HIPAA security officer within 24 hours of the discovery of the incident. The HIPAA privacy officer and HIPAA security officer will collaborate with local/department IT staff to determine how best to initiate an investigation about an incident.

      HIPAA incident reports should be submitted online via the reporting mechanism available at compliance.wisc.edu/hipaa.

   2. If an incident is reported to a local/department IT office, that office will immediately notify the HIPAA privacy officer or HIPAA security officer, and also submit the details of the incident online via the reporting mechanism available at compliance.wisc.edu/hipaa. The investigation will then proceed as outlined in I.3-I.5, above.
   3. If additional information from the UW–Madison chief information officer (CIO) is needed to investigate an incident, or as otherwise directed by the HIPAA security officer, the CIO’s chief information security officer (CISO) will participate in the investigation and provide findings to the HIPAA privacy and security officers without unreasonable delay and in no case more than 30 days from the date of discovery of the incident. The investigation shall then proceed as outlined in I.3-I.5, above.
   4. If the HIPAA security officer or CIO determines that an administrative leadership team should assemble as described in the CIO’s Information Incident Reporting and Response Policy, the administrative leadership team will include the HIPAA privacy officer. Upon completion of the administrative leadership team's analysis, the investigation will then proceed as outlined in I.3-I.5, above.
3. Breach Determination.
   1. The HIPAA privacy officer, in consultation with the UW–Madison HIPAA security officer and the HIPAA Privacy and Security Operations Committee, as needed or as time permits, will make the final determination of whether a breach has occurred.
   2. The HIPAA privacy officer will notify the UW–Madison HIPAA Privacy and Security Executive Board of any required breach notifications.
4. Breach Notifications. If it is determined that a breach of unsecured protected health information has occurred, the following notifications are made in accordance with HITECH regulations:
   1. Notification to Affected Individuals.
      1. Without unreasonable delay and in no case later than 60 calendar days after discovery of a breach, the HIPAA privacy officer notifies each individual whose unsecured protected health information has been, or is reasonably believed to have been, accessed, acquired, used, or disclosed as a result of a breach.
      2. The HIPAA privacy officer will draft and sign any notification letter(s), in consultation as needed with the privacy coordinator of the relevant HCC unit in the drafting. The UW–Madison Office of Compliance will ensure timely mailing of any notification letter(s).
      3. The notification, written in plain language, will include, to the extent possible:
         1. A brief description of what happened, including the date of the breach and the date of the discovery of the breach, if known;
         2. A description of the types of unsecured protected health information that were involved in the breach (e.g., full name, social security number, date of birth, home address, account number, diagnosis, disability code, and/or other types of information);
         3. Any steps individuals should take to protect themselves from potential harm resulting from the breach;
         4. A brief description of what UW–Madison is doing to investigate the breach, to mitigate harm to individuals, and to protect against any further breaches; and
         5. Contact procedures for individuals to ask questions or learn additional information, which will include a toll-free telephone number, an email address, website, or postal address.
      4. The notification required will be provided in the following form:
         1. Written notification by first-class mail to the individual at the last known address of the individual or, if the individual agrees to electronic notice and such agreement has not been withdrawn, by electronic mail. The notification may be provided in one or more mailings as information is available.
         2. If UW–Madison knows the individual is deceased and has the address of the next of kin or personal representative of the individual, written notification by first-class mail to either the next of kin or personal representative of the individual. The notification may be provided in one or more mailings as information is available.
      5. If there is insufficient or out-of-date contact information that precludes written notification to the individual, a substitute form of notice reasonably calculated to reach the individual will be provided (this does not apply to the next of kin or personal representative of the individual).
         1. If there is insufficient or out-of-date contact information for fewer than 10 individuals, then such substitute notice may be provided by an alternative form of written notice, telephone, or other means.
         2. If there is insufficient or out-of-date contact information for 10 or more individuals, then such substitute notice will:
            1. Be in the form of either a conspicuous posting for a period of 90 days on the hipaa.wisc.edu home page or a conspicuous notice in major print or broadcast media in geographic areas where the individuals affected by the breach likely reside; and
            2. Include a toll-free phone number that remains active for at least 90 days where an individual can learn whether the individual's unsecured protected health information may be included in the breach.
         3. In any case deemed to require urgency because of possible imminent misuse of unsecured protected health information, the HIPAA privacy officer may provide information to individuals by telephone or other means, as appropriate, in addition to notice provided as described above.
   2. Notification to the Secretary of the U.S. Department of Health and Human Services (HSS).
      1. For a breach involving 500 or more individuals, the HIPAA privacy officer provides notification to the secretary contemporaneously with the notice to affected individuals in the manner specified on the HHS website.
      2. For a breach involving less than 500 individuals, the HIPAA privacy officer or the privacy and security program coordinator at their direction maintains a log or other documentation of such breaches and, not later than 60 days after the end of each calendar year, provides the notification for breaches discovered during the preceding calendar year, in the manner specified on the HHS web site.
   3. Notification to the Media. For a breach involving more than 500 residents of the state, the UW–Madison HIPAA privacy officer in conjunction with the Office of Strategic Communication will, contemporaneously with the notice to affected individuals and to the Secretary of HHS, notify prominent media outlets serving the state.
   4. Law Enforcement Delay. If a law enforcement official states that a notification, notice, or posting required by HIPAA would impede a criminal investigation or cause damage to national security, the HIPAA privacy officer will:
      1. If the statement is in writing and specifies the time for which a delay is required, delay such notification, notice, or posting for the time period specified by the official; or
      2. If the statement is made orally, document the statement, including the identity of the official making the statement, and delay the notification, notice, or posting temporarily and no longer than 30 days from the date of the oral statement, unless a written statement as described above is submitted during that time.
   5. The HIPAA privacy officer will notify the HIPAA Privacy and Security Operations Committee and the HIPAA Executive Board when all required notifications have been made.
5. In the event an incident involves research subjects, the HIPAA privacy officer will notify the appropriate institutional review board (IRB) upon learning of the incident if it is unclear that the IRB is already aware, and will work with such IRB to ensure that any proposed remediation does not conflict with IRB determinations, policies or laws governing human subjects research.
6. Both breaches and incidents determined not to be breaches will be reported to the HIPAA Privacy and Security Operations Committee by the HIPAA privacy officer for discussion of possible remedial or preventive actions.
7. Documentation Requirements. The UW–Madison HIPAA Breach Analysis Form must be completed for each incident investigation.

Consequences for Noncompliance

Failing to comply with this policy may result in discipline for the individual(s) responsible for such noncompliance.

Further, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) is responsible for enforcing the HIPAA Privacy and Security Rules, and an individual’s noncompliance may result in institutional noncompliance and/or an investigation by OCR. OCR attempts to resolve investigations by obtaining voluntary compliance and entering into corrective action plans and resolution agreements. Failure to comply with HIPAA or cooperate with OCR in an investigation may result in civil and/or criminal penalties.

Related UW–Madison Documents, Web Pages, or Other Resources:

Additional information may be found at www.compliance.wisc.edu/hipaa

External References:

45 C.F.R. Subpart D

Policy Administration

Approval Authority:

Vice Chancellor for Legal Affairs

Policy Manager:

HIPAA Privacy Officer

Contact:

HIPAA Privacy Officer -- Jack Talaska, JACK.TALASKA@WISC.EDU, (608) 265-4077

Effective Date:

09-30-2014

Revised Dates:

09-30-2014: Effective date of the revised policy: 09-30-2014.
11-29-2017: Effective date of the revised policy: 11-29-2017.
03-26-2020: Effective date of the revised policy: 03-26-2020.

Retrieved:

01-19-2025 01:44:53