The new rules in the Health Insurance Portability and Accountability Act (HIPAA) include changes to the definition of “breach,” regulatory enforcement provisions, requirements for notices of privacy practices, and the sale of protected health information (PHI).
Breach. The most significant change to the Breach Notification Rule is the definition of the term breach. HHS defines breach as the acquisition, access, use, or disclosure of PHI in violation of the Privacy Rule that compromises the security or privacy of the PHI. The Privacy Rule requires that covered entities apply reasonable safeguards to all PHI. Thus, even PHI that was protected in accordance with the Privacy and Security Rules, such as by use of firewalls, but was breached under the terms of the new Breach Notification Rule, would have to be reported. As used in this subpart, the following terms have the following meanings: Breach. means the acquisition, access, use, or disclosure of protected health information in a manner not permitted under subpart E of this part which compromises the security or privacy of the protected health information. (1) Breach excludes: Unsecured Protected Health Information. means protected health information that is not rendered unusable, unreadable, or indecipherable to unauthorized persons through the use of a technology or methodology specified by the Secretary in the guidance issued under section 13402(h)(2) of Pub. L. 111-5. The new rules in the Health Insurance Portability and Accountability Act (HIPAA) include changes to the definition of “breach,” regulatory enforcement provisions, requirements for notices of privacy practices, and the sale of protected health information (PHI).  IS IT A BREACH (NOW)? •“Breach” means the acquisition, access, use, or disclosure of protected health information in a manner not permitted under subpart E which compromises the security or privacy of the protected health information. “UNSECURED PHI” IS: •“Unsecured protected health information” means protected health information [PHI] that is not rendered unusable, unreadable, or indecipherable to unauthorized persons through the use of a technology or methodology specified by the Secretary in the guidance under section 13402(h)(2) of Pub. L. 111-5. Breach Definition Changes 45 C.F.R. 164.402 Breach means the acquisition, access, use, or disclosure of protected health information in a manner not permitted under subpart E of this part which compromises the security or privacy of the protected health information. “UNSECURED PHI” IS: •“Unsecured protected health information” means protected health information [PHI] that is not rendered unusable, unreadable, or indecipherable to unauthorized persons through the use of a technology or methodology specified by the Secretary in the guidance under section 13402(h)(2) of Pub. L. 111-5. According to the Department of Defense (DoD), a breach of personal information occurs when the information is lost, disclosed to, accessed by, or potentially exposed to unauthorized individuals, or compromised in a way where the subjects of the information are negatively affected. 1  Full DoD breach definition.  The Definition of Breach. This posting is one of several that outline the HITECH privacy provisions of the American Recovery and Reinvestment Act that President Obama signed into law on Tuesday, February 17, 2009, in Denver, CO. Here, we reproduce the definitions that appear in Subtitle D—Privacy, Section 13400. The final rule changes this definition by stating that, unless an exception applies, an impermissible use or disclosure of PHI is presumed to be a breach, unless the HIPAA-covered entity can demonstrate there is a low probability that the PHI has been compromised based upon, at minimum, a four-part risk assessment. The Privacy Rule requires that covered entities apply reasonable safeguards to all PHI. Thus, even PHI that was protected in accordance with the Privacy and Security Rules, such as by use of firewalls, but was breached under the terms of the new Breach Notification Rule, would have to be reported.
http://www.duanemorris.com/alerts/new_HIPAA_breach_notification_rule_may_prove_costly_for_HIPAA-covered_entities_4728.html http://www.hipaasurvivalguide.com/hipaa-regulations/164-402.php http://www.ucop.edu/risk-services/_files/hipaa-final-rule-022013.pdf http://www.wedi.org/forms/uploadFiles/34E940000049D.filename.Webinar_OCR__WEDI_July_17_-_FINAL.pdf http://www.wedi.org/forms/uploadFiles/34E940000049D.filename.Webinar_OCR__WEDI_July_17_-_FINAL.pdf http://www.health.mil/Military-Health-Topics/Privacy-and-Civil-Liberties/Breaches-of-PII-and-PHI http://www.hipaa.com/the-definition-of-breach/ http://www.duanemorris.com/alerts/new_HIPAA_breach_notification_rule_may_prove_costly_for_HIPAA-covered_entities_4728.html
hipaa breach definition