What happens when ePHI is exposed: security incidents versus breaches, the four-factor risk assessment, notification to individuals, media and HHS, business associate duties, reporting through the OCR portal and ransomware.
The Breach Notification Rule obligations after a breach of unsecured PHI: individual notice within 60 days, required content, substitute notice, media notice above 500 residents, notice to HHS, written policies and training, and the FTC rule for health record vendors.
How to decide whether an impermissible use or disclosure is a reportable breach: the presumption of breach, the four factors, the three exceptions, encryption and destruction safe harbors, notifying without an assessment, and the documentation that carries the burden of proof.
How HHS treats ransomware under HIPAA: ransomware as a security incident, why encryption by attackers counts as acquisition, when previously encrypted data is still breached, response steps, and recent OCR ransomware settlements.
The difference between a Security Rule security incident and a Breach Notification Rule breach: definitions, the incident response and documentation duty, business associate incident reporting, when an incident becomes a breach, and the proposed incident response plan rule.
How and when to report a breach to the HHS Secretary: the 500-individual threshold, annual reporting of smaller breaches, the online portal, estimates and addenda, reports by business associates, the public breach list, and how breach reports start OCR investigations.
What a business associate must do when it has a breach: notice to the covered entity within 60 days, when discovery starts the clock, delegating individual notices, contract reporting terms, direct liability and cases where notice came too late.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.