Instructions
This assignment lists several scenarios that include potential privacy and/or security breaches in the United States. For each question, please determine:
1. Do any HIPAA exceptions apply?
2. Using the four-factored risk assessment, determine whether there was a privacy breach. (Complete the table.)
3. Is the breach reportable to OCR and/or the Secretary? Why or why not?
Please explain your analysis for each scenario and question. For the purposes of this assignment, all of the healthcare facilities described in the following scenarios conduct business in California, and all patients are California residents.
Scenario 1
An employee at Health Facility A reported to the Privacy department that his laptop was stolen. IS determined that the laptop was unencrypted, and that the laptop contained 2,000 patients’ first and last names, medical record numbers (MRNs), and medical history information from Health Facility A. IS cannot ascertain whether the person in receipt of the stolen laptop has actually viewed any of the patients’ health information.
1. Do any HIPAA exceptions apply?
2. Four-factored Risk Assessment
1. Nature and extent of information involved
• Is the type of Protected Health Information (PHI) sensitive in nature (for example, financial or clinical in nature)?
• Could the information be used by the recipient in a manner adverse to the individual?
• Is there a likelihood that the PHI released could be reidentified based on the context and ability to link the information with other information?
2. Unauthorized person/entity to whom the information was disclosed/used
• Is the unauthorized recipient obligated to protect the privacy and security of the PHI?
• Is the recipient able to reidentify the information?
• Does the impermissible use or disclosure result in further impermissible disclosure outside the entity?
3. Was the PHI actually acquired or viewed?
• Was there merely an opportunity to acquire or view the PHI?
4. Has the risk to the PHI been mitigated?
• Was the information returned, recovered, or destroyed by the unauthorized recipient?
• Are there satisfactory assurances from the recipient that PHI will not be further used or disclosed (for example, confidentiality agreement)?
3. Is the breach reportable to OCR and/or the Secretary?
Scenario 2
An employee at Health Facility D searched the facility’s encrypted Electronic Health Record (EHR) for patient X’s medical record using patient X’s first and last name. The employee is a nurse in the pediatric department of Health Facility C. The patient is a geriatric patient, and not under the nurse’s care. The nurse accessed patient X’s entire medical history and disclosed the patient’s medical history on social media.
1. Do any HIPAA exceptions apply?
2. Four-factored Risk Assessment
1. Nature and extent of information involved
• Is the type of PHI sensitive in nature (for example, financial or clinical in nature)?
• Could the information be used by the recipient in a manner adverse to the individual?
• Is there a likelihood that the PHI released could be reidentified based on the context and ability to link the information with other information?
2. Unauthorized person/entity to whom the information was disclosed/used
• Is the unauthorized recipient obligated to protect the privacy and security of the PHI?
• Is the recipient able to reidentify the information?
• Does the impermissible use or disclosure result in further impermissible disclosure outside the entity?
3. Was the PHI actually acquired or viewed?
• Was there merely an opportunity to acquire or view the PHI?
4. Has the risk to the PHI been mitigated?
• Was the information returned, recovered, or destroyed by the unauthorized recipient?
• Are there satisfactory assurances from the recipient that PHI will not be further used or disclosed (for example, confidentiality agreement)?
3. Is the breach reportable to OCR and/or the Secretary?
Scenario 3
An employee at Health Facility E searched the facility’s encrypted Electronic Health Record (EHR) for patient X’s medical record using patient X’s first and last name. After the Privacy Office conducted an audit trail of the employee’s search, it was determined that the employee only accessed patient X’s MRN and date of birth.
1. Do any HIPAA exceptions apply?
2. Four-factored Risk Assessment
1. Nature and extent of information involved
• Is the type of PHI sensitive in nature (for example, financial or clinical in nature)?
• Could the information be used by the recipient in a manner adverse to the individual?
• Is there a likelihood that the PHI released could be reidentified based on the context and ability to link the information with other information?
2. Unauthorized person/entity to whom the information was disclosed/used
• Is the unauthorized recipient obligated to protect the privacy and security of the PHI?
• Is the recipient able to reidentify the information?
• Does the impermissible use or disclosure result in further impermissible disclosure outside the entity?
3. Was the PHI actually acquired or viewed?
• Was there merely an opportunity to acquire or view the PHI?
4. Has the risk to the PHI been mitigated?
• Was the information returned, recovered, or destroyed by the unauthorized recipient?
• Are there satisfactory assurances from the recipient that PHI will not be further used or disclosed (for example, confidentiality agreement)?
3. Is the breach reportable to OCR and/or the Secretary?
Scenario 4
A nurse at Health Facility G mistakenly hands patient X’s discharge papers to patient Y. Patient Y holds the discharge papers for about 15 seconds. The nurse realized her mistake and immediately recovered the discharge papers from patient Y.
1. Do any HIPAA exceptions apply?
2. Four-factored Risk Assessment
1. Nature and extent of information involved
• Is the type of PHI sensitive in nature (for example, financial or clinical in nature)?
• Could the information be used by the recipient in a manner adverse to the individual?
• Is there a likelihood that the PHI released could be reidentified based on the context and ability to link the information with other information?
2. Unauthorized person/entity to whom the information was disclosed/used
• Is the unauthorized recipient obligated to protect the privacy and security of the PHI?
• Is the recipient able to reidentify the information?
• Does the impermissible use or disclosure result in further impermissible disclosure outside the entity?
3. Was the PHI actually acquired or viewed?
• Was there merely an opportunity to acquire or view the PHI?
4. Has the risk to the PHI been mitigated?
• Was the information returned, recovered, or destroyed by the unauthorized recipient?
• Are there satisfactory assurances from the recipient that PHI will not be further used or disclosed (for example, confidentiality agreement)?
3. Is the breach reportable to OCR and/or the Secretary?
