Imagine this: it’s a quiet Wednesday morning at the practice. As you’re watching the clock tick criminally slow to lunch hour, you check your email. It looks like your boss sent you an email!  He wants you to print out the attached file. You absent-mindedly click on the file, and your once quiet morning is completely flipped on its head. 

The email was a phishing scam! If you looked a bit harder, you would have noticed it didn’t actually come from your boss, but an unknown suspicious email. 

The malware begins to infect your computer, starting to wreak havoc. What are you going to do? 

Email phishing scams are a common example of a breach, exposing patient data. Other forms of breaches include: stolen laptops, improper disposal of PHI, and overall, any time unauthorized access to sensitive patient data.

Breaches, unfortunately, happen pretty often, affecting millions of patients. In 2023, over 133 MILLION patients’ information was exposed in breaches. 

What’s the HIPAA Breach Notification Rule? 

Now that we’ve painted a scary picture, let’s talk about what you can do. This is where HIPAA’s Breach Notification Rule comes in. The Breach Notification Rule is one of the pillars of HIPAA and guides Covered Entities (CEs) and Business Associates (BAs) when it comes to breaches. It mandates required information about a breach and how patients need to be notified of their exposed data.

What Should I Do? 

Well, first, don’t panic! Time is of the essence when it comes to a breach. 

Here’s a step-by-step guide on what to do if you suspect a data breach:

1.Contain the Breach: First things first, stop the attack! If dealing with a cyber attack, like an email phishing scheme, disconnect the infected computer immediately, so it can’t spread the nasty virus to other computers on the network. Report the incident to your IT department or IT partner immediately.

2. Investigate the Breach: Time to play a bit of Sherlock Holmes and investigate the attack. What data was accessed or potentially accessed? How many individuals are potentially affected? How did the breach occur? 

All of these questions are vital when it comes to reporting this breach and notifying patients. In the Abyde software, we have our breach log, a quick questionnaire for you to organize your investigation.Notification Requirements: Depending on the severity of the breach, notifications may need to be sent to several parties:

3. Notification Requirements: Depending on the severity of the breach, notifications may need to be sent to several parties:

• Patients: The notification should explain the breach, what information was potentially exposed, and steps individuals can take to protect themselves.

• OCR: This is a bit different depending on how many people were impacted by a breach. 
• For breaches impacting less than 500 people, these breaches need to be reported to the OCR within 60 days of the end of the year. 
• For breaches impacting more than 500, this breach needs to be reported within 60 days of the event. Additionally, different states have different reporting requirements for state-level departments.
• To report to the OCR, here is the reporting form. The Abyde breach log includes all the information needed for the OCR, simplifying the process for your practice or business.  

4. Mitigation and Prevention:

Well, hopefully, that never happens again! Now, it’s time to take steps to prevent similar breaches in the future. This involves: 

• Improving employee training on common breaches, ie – email safety.
• Strengthening access controls to prevent unauthorized access to PHI.
• Encrypting sensitive data in case of a breach.

How Abyde Can Help

Mitigating breaches and protecting patient privacy can be daunting. Abyde can help! We offer a plethora of resources on compliance and data security best practices. As discussed above, Abyde assists with every step of the breach process, from proactively identifying risks and vulnerabilities with the Security Risk Analysis, to training, to breach logs. 

Want to learn more about how Abyde can help you Never Stress Over Compliance Again? Email info@abyde.com, and schedule a compliance consultation here and here for Business Associates.