The HITECH definition of breach is the "unauthorized acquisition, access, use, or disclosure of PHI which compromises the security privacy of such information." It poses a significant risk of financial, reputation, or other harm to the affected individual. It is an act that compromises security or privacy. Breaches include theft, loss, unauthorized access and disclosure, hacking, and improper disposal. Portable devices such as laptop computers preset one of the greatest breach risks, although breaches of portable devices have involved both malicious and accidental activities. The HHS database may be searched by name of covered entity, state, number of individuals affected, date of breach, type of breach and location of breached information.
Covered entities must notify affected individuals following the discovery of a breach of unsecured protected health information. Covered …show more content…
This notification to the HHS needs to be done at the same time that the individuals who are affected are notified.
With breaches that involve less than 500 individuals, covered entities have to maintain a record of the breaches and submit them to the HHS within "60 days after the end of the calendar year in which the breach occurred."
Some exceptions to a breach are unintentional acquisition (by a workforce member acting under the authority of a covered entity or business associate), inadvertent disclosure (from a person authorized to access PHI at a covered entity or business associate to another person authorized to access PHI at a covered entity or business associate), recipient would not be able to retain information (does not include disclosure of PHI if the covered entity or BA has a good faith belief the unauthorized individual who received the PHI would not be able to retain the
Covered entities must notify affected individuals following the discovery of a breach of unsecured protected health information. Covered …show more content…
This notification to the HHS needs to be done at the same time that the individuals who are affected are notified.
With breaches that involve less than 500 individuals, covered entities have to maintain a record of the breaches and submit them to the HHS within "60 days after the end of the calendar year in which the breach occurred."
Some exceptions to a breach are unintentional acquisition (by a workforce member acting under the authority of a covered entity or business associate), inadvertent disclosure (from a person authorized to access PHI at a covered entity or business associate to another person authorized to access PHI at a covered entity or business associate), recipient would not be able to retain information (does not include disclosure of PHI if the covered entity or BA has a good faith belief the unauthorized individual who received the PHI would not be able to retain the