• Best Practices New Normal
  • Digital Dentistry
  • Data Security
  • Implants
  • Catapult Education
  • COVID-19
  • Digital Imaging
  • Laser Dentistry
  • Restorative Dentistry
  • Cosmetic Dentistry
  • Periodontics
  • Oral Care
  • Evaluating Dental Materials
  • Cement and Adhesives
  • Equipment & Supplies
  • Ergonomics
  • Products
  • Dentures
  • Infection Control
  • Orthodontics
  • Technology
  • Techniques
  • Materials
  • Emerging Research
  • Pediatric Dentistry
  • Endodontics
  • Oral-Systemic Health

4 crucial steps for dealing with a data breach


A data breach in the dental industry isn’t just nerve-wracking – it’s also expensive and can potentially shut a practice down. The bad news is nearly every company will experience a data breach of some kind during the life of their company.

A data breach in the dental industry isn’t just nerve-wracking – it’s also expensive and can potentially shut a practice down. The bad news is nearly every company will experience a data breach of some kind during the life of their company. 

Across all business sectors in 2014, there were approximately 783 data breaches that resulted in 85 million records being compromised. In the healthcare industry alone, there were 333 breaches and 8.2 million records compromised.

More from Dr. Lavine: The 5 crucial components of a HIPAA contingency plan

There’s a lot of confusion on what constitutes a breach in the healthcare industry. Under HIPAA, it is presumed that an impermissible use or disclosure of protected health information (PHI) is a breach unless the covered entity or business associate demonstrates that there is a low probability that the PHI was compromised.

To make that determination, HIPAA mandates that those organizations perform a risk assessment on at least four factors. 

Continue to the next page to read about the factors.






Step 1: Assess the nature and extent of involved PHI and likelihood of identification

When determining the risk of harm to an individual, it’s important to determine what information was exposed and the likelihood of identification? Take a closer look at the PHI that was inappropriately disclosed or used. Is it more sensitive in nature? Do they include financial records? What was the level of detail in the record?

Related reading: Risky Business: HIPAA compliance and the importance of risk analysis assessments

Assessing this information will help to mandate the urgency in which you deal with the issue. For example, you’ll feel far more pressed to deal with a breach in financial records than you will to deal with a breach in outdated information.

This information is one step that will assist an organization in determine if there is a low risk that the PHI was compromised. However, all four factors must be considered before a determination is made.




Step 2: Determine the unauthorized person who used the PHI or to whom the disclosure was made

The next step involves tracing the breach back to the source and identifying the perpetrator and/or the person to whom the information was disclosed. This often occurs as a mistake on the part of the employee.

Related reading: To encrypt or not to encrypt ... It's not really a question!

For example, an employee that meant to send an encrypted email file to the acting physician may have mistakenly sent it to a different party or included unauthorized personnel in the email correspondence. If this is the case, it’s fairly simple to trace it back to the source. From there, steps can be taken to reinforce policies to rectify the situation.

Other times the impermissible use or disclosure involves a third party. Determining who received the PHI is an important factor, as it may weigh heavily towards a decision that the data had a low probability of being compromised.




Step 3: Establish whether the PHI was actually acquired or viewed

The best-case scenario is that breached data is never viewed or acquired. This may happen, for example, if it’s a laptop that was stolen or lost is returned, but an unauthorized person never opened it. This is going to be a factor in determining if the PHI was compromised.

More from Dr. Lavine: 3 things you must do if a data breach occurs in your dental practice

At times, a forensic data analysis can determine whether or not the information was accessed, viewed, acquired, altered, transferred, or otherwise compromised. This step, combined with the other three, can help you determine whether a breach actually occurred.





Step 4: Evaluate the extent to which the risk to the PHI has been mitigated

All risks to the PHI should be mitigated in order to reduce legal implications and protect the information.  The responsible covered entity could request a letter of attestation that the PHI was destroyed.

This step depends a lot on the third party’s actions following the data breach and their willingness to cooperate with efforts to mend the situation.

After all four steps have been considered and documented, the covered entity or business associate must, in good faith, make the determination whether there was a low probability that the PHI was compromised. If the covered entity or third party cannot make that determination, breach notification is required.


Related Videos
CDA 2024 Video Interview with Kuraray Noritake's Dinesh Weerasinghe and Richard Young, DDS
Mastermind – Episode 35 – Finding Strength in Our Differences
The Uptime Health Story: An Interview with Uptime Health CEO and Co-Founder Jinesh Patel
Mastermind – Episode 34: Proactive Dentistry, Diagnostics, and Early Detection
2024 Dental Products Report Spring Selection Bracket Reveal Video
Process of Care Workflow and Repairing Early Caries with Guided Enamel Remineralization
Addressing Unmet Needs in Early Childhood Oral Care - an interview with Ashlet Lerman, DDS
Mastermind Episode 33 – Charting the Course for the Future of Dentistry
CDS 2024 Midwinter Meeting – Interview with Debbie Zafiropoulos, who discusses a trio of new infection control products from Armis Biopharma.
Related Content
© 2024 MJH Life Sciences

All rights reserved.