Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

This is an entirely hypothetical question.

Lets say a clinic has a computer in their waiting room for checking email, surfing the web etc. while patients wait. Lets also assume whoever signed this up wasn't thinking, and this machine is just sitting on an unsecured network for the clinic, and can access patient files stored on other systems.

Lets assume however that all the users of this are well-intentioned, computer illiterate people who click on the Firefox icon and nothing else - they never actually access the patient data, they just could.

Is this, by itself, a HIPAA breach, and if so, how large of a breach is it?

share|improve this question

migrated from healthcareit.stackexchange.com Apr 30 '12 at 22:44

This question came from our site for healthcare IT professionals and solution providers.

    
The assumption that every single patient in a hospital waiting room is a well-intentioned computer-illiterate is quite naive. You think hackers never need medical attention? –  Philipp May 7 at 6:54
    
@Philipp It's what we call a "simplifying assumption" - is there a breach according to the law even if nothing happened, and no one tried to make anything happen. –  Fomite May 7 at 13:57

4 Answers 4

up vote 14 down vote accepted

Just going by the guidance on the US Heath & Human Services website:

A breach is, generally, an impermissible use or disclosure under the Privacy Rule that compromises the security or privacy of the protected health information such that the use or disclosure poses a significant risk of financial, reputational, or other harm to the affected individual.

"Disclosure" implies that the data was disclosed to someone, which is not true in your example. Also, it does not seem like there was "significant risk of ... harm" if nobody actually saw the data.

Another mitigating factor: Although the terminal might be unlocked, a HIPAA-compliant patient data system will have an idle lockout for precisely this reason. Also they will have audit trails of whether that user accessed any patient data, so you would know for certain if there were an actual breach.

Editing to add based on my comment to @Alex:

Leaving patient data on an unsecured network is a violation of HIPAA Privacy Rule and a very bad thing in general. However, the breach does not occur until someone takes advantage of that security hole.

share|improve this answer

they never actually access the patient data, they just could.

It may not be a breach of PHI as defined by law until someone touches it -- depends how your lawyer sees the word 'disclosure' -- but it's a breach in the English language sense of HIPAA rules. PHI should either be locked behind a closed system, or encrypted. A system isn't closed if it's accessible by people who have no business with it.

As for the well-meaning computer illiterates, it's a matter of time before a bored patient (or child of patient) starts exploring.

edit: I would actually never recommend leaving even encrypted PHI in an accessible location.

share|improve this answer
1  
What you said about protecting PHI is absolutely correct. I think it's a question of terminology. Leaving patient data on an unsecured network is a violation of HIPAA Privacy Rule. A breach occurs when someone takes advantage of that security hole. –  Lynn Oct 28 '11 at 17:20

The important thing as far as defining a breach is when you need to disclose that a breach occurred. Certainly part of this is a legal question and I'm not a lawyer. You'll find this series of posts about when to disclose interesting: http://www.emrandhipaa.com/tag/jan-mcdavid/

Here's a section of one of the articles: First and foremost, you do not have to notify the patient each and every time there is a breach of protected health information (PHI). The law requires notification only if you meet one of two conditions: 1) When 500 or more records have been breached at the same time, you must notify the patients involved, OR 2) When you as the covered entity (CE) have conducted the required “risk analysis” and determined the patient (or patients) could suffer substantial financial or reputational harm.

share|improve this answer

I just attended a conference put on by a law firm, they said that a hosptial was fined a substantial amount of money because the cleaning crew had access to the medical records and Employee records room after hours when no one was in the offices.

They where hospital employees that has HIPAA training, but it was a fine for a situation that could have lead to a PHI breach.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.