4 crucial steps for dealing with a data breach

January 13, 2016

Lorne Lavine, DMD

Article

A data breach in the dental industry isn’t just nerve-wracking – it’s also expensive and can potentially shut a practice down. The bad news is nearly every company will experience a data breach of some kind during the life of their company.

Across all business sectors in 2014, there were approximately 783 data breaches that resulted in 85 million records being compromised. In the healthcare industry alone, there were 333 breaches and 8.2 million records compromised.

There’s a lot of confusion on what constitutes a breach in the healthcare industry. Under HIPAA, it is presumed that an impermissible use or disclosure of protected health information (PHI) is a breach unless the covered entity or business associate demonstrates that there is a low probability that the PHI was compromised.

To make that determination, HIPAA mandates that those organizations perform a risk assessment on at least four factors.

Continue to the next page to read about the factors.

Step 1: Assess the nature and extent of involved PHI and likelihood of identification

When determining the risk of harm to an individual, it’s important to determine what information was exposed and the likelihood of identification? Take a closer look at the PHI that was inappropriately disclosed or used. Is it more sensitive in nature? Do they include financial records? What was the level of detail in the record?

Assessing this information will help to mandate the urgency in which you deal with the issue. For example, you’ll feel far more pressed to deal with a breach in financial records than you will to deal with a breach in outdated information.

This information is one step that will assist an organization in determine if there is a low risk that the PHI was compromised. However, all four factors must be considered before a determination is made.

Step 2: Determine the unauthorized person who used the PHI or to whom the disclosure was made

The next step involves tracing the breach back to the source and identifying the perpetrator and/or the person to whom the information was disclosed. This often occurs as a mistake on the part of the employee.

For example, an employee that meant to send an encrypted email file to the acting physician may have mistakenly sent it to a different party or included unauthorized personnel in the email correspondence. If this is the case, it’s fairly simple to trace it back to the source. From there, steps can be taken to reinforce policies to rectify the situation.

Other times the impermissible use or disclosure involves a third party. Determining who received the PHI is an important factor, as it may weigh heavily towards a decision that the data had a low probability of being compromised.

Step 3: Establish whether the PHI was actually acquired or viewed

The best-case scenario is that breached data is never viewed or acquired. This may happen, for example, if it’s a laptop that was stolen or lost is returned, but an unauthorized person never opened it. This is going to be a factor in determining if the PHI was compromised.

At times, a forensic data analysis can determine whether or not the information was accessed, viewed, acquired, altered, transferred, or otherwise compromised. This step, combined with the other three, can help you determine whether a breach actually occurred.

Step 4: Evaluate the extent to which the risk to the PHI has been mitigated

All risks to the PHI should be mitigated in order to reduce legal implications and protect the information. The responsible covered entity could request a letter of attestation that the PHI was destroyed.

This step depends a lot on the third party’s actions following the data breach and their willingness to cooperate with efforts to mend the situation.

After all four steps have been considered and documented, the covered entity or business associate must, in good faith, make the determination whether there was a low probability that the PHI was compromised. If the covered entity or third party cannot make that determination, breach notification is required.