This is the sixth Administrative Safeguard Standard of the HIPAA Administrative Simplification Security Rule. This is its one implementation specification, Response and Reporting, which is required for compliance. As we have noted in earlier postings, with enactment of the American Recovery and Reinvestment Act of 2009 ("ARRA") on February 17, 2009, business associates also will be required to comply with the Security Rule standards, effective February 17, 2010.What to DoThis standard requires that the covered entity implement response and reporting policies to address security incidents. A security incident is defined as "the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system." [68 Federal Register 8376] As a covered entity, you are required to identify, respond to, and to mitigate any harmful effects of security incidents, and to document the incidents, actions taken, and outcomes.How to Do ItThe covered entity’s Security Official is responsible for identifying, containing, mitigating, and documenting a security incident. A security incident might be leaving electronic protected health information on a computer that is donated to a local organization. The Security Official would determine the extent of the damage that occurred if the electronic protected health information were accessed by unauthorized persons, and implement measures to mitigate the damage, such as immediately recovering the computer. The Privacy Official, if different from the Security Official, may be called in to help mitigate the breach, as a security incident is called in the Privacy Rule, if the breach results in an unauthorized disclosure of electronic protected health information.Another example of a security incident could be the destruction of or damage to electronic protected health information caused by a system intrusion, such as a suspect email or virus. Failure to report and respond to the incident could create a serious problem if electronic protected health information, such as patient records, were altered or destroyed.The requirements of this implementation specification are met by information compiled and analyzed as part of the covered entity’s required risk analysis. In the risk analysis, the covered entity will identify vulnerabilities and potential threats. As part of contingency and disaster recovery planning, the covered entity will identify responses that will mitigate those risks.The Security Official is responsible for documenting the security incident in writing, and maintaining the documentation in written or electronic format for at least six years. Lessons learned are important outcomes of the documentation process, so the covered entity should review the security incident documentation periodically as part of updating the risk analysis.Each covered entity should prepare and maintain a Security Incident Report and a Security Incident Log. The Security Incident Report should contain the following information:
» Description of Attempted or Actual Security Incident
» Date, Time, and Location of the Incident
» Person Who Discovered the Security Incident
» How the Security Incident Was Discovered
» Evidence of the Security Incident
» Actions Taken to Mitigate Damages to Covered Entity’s Electronic Systems and Protected Health Information
» Policy and Procedure Changes Implemented to Avoid Recurrence
» Date of Security Incident Report
» Name and Signature of Security Official
For Each Line Entry in the Security Incident Log, Date, Location, Description, and Severity of the Security Incident, with Severity Ranked from 1 (Least Serious) to 5 (Most Serious) should be included. Remember, the covered entity must retain these documents at least six years from last entry.
HIPAA.com cofounder Ed Jones is a consultant and author of books on healthcare privacy, security, and electronic health records. He was an SVP at an NYSE-traded health plan insurer and held senior roles at the US Department of Justice and the CIA.
When a HIPAA breach hits, delay costs money. Build your response team before you need it: a data privacy attorney first (to help protect the investigation under privilege), then forensic and IT consultants, media relations, and HR.
I am asked that question almost weekly. While the answer has traditionally been “no,” the legal landscape is shifting and the risk of being sued continues to increase.
Let’s
A party’s responsibilities under HIPAA generally come from two sources - the law itself and the business associate agreement entered into between the covered entity (the health care provider or
June 7, 2013. Today, HHS published in the Federal Register "Technical Corrections to the HIPAA Privacy, Security, and Enforcement Rules" that were published on January 25, 2013, as
June 7, 2013. Today, HHS published in the Federal Register "Technical Corrections to the HIPAA Privacy, Security, and Enforcement Rules" that were published on January 25, 2013, as
The Final Rule took effect March 26, 2013, with 180 days to comply. How the 180-day rule works for future HIPAA changes, which deadlines didn’t move, and the longer transition for existing business associate agreements.
How the 2013 Final Rule changed delivery of the Notice of Privacy Practices: when health plans must post or mail a revised notice after a material change, what stays the same for providers, and how to keep notices accessible.
March 22, 2013. Today, we continue going through the HIPAA Privacy Rule, section by section, as modified in the Final Rule: Modifications to the HIPAA Privacy, Security, Enforcement, and Breach
