418 HIPAA breaches happened in 2019 alone.

OK, maybe you don’t think that’s bad...and if you’re comparing it to the total number of organizations that need to follow this rule, it’s not.

What if I told you that those 418 HIPAA breaches led to almost 35 million Americans having their PHI compromised.

To add even more perspective on what I just said, 35 million people is almost 10% of the entire population of the United States. At that rate it would only take another 9 years until the entire US population’s PHI is leaked.

Obviously there’s a lot that goes into preventing a HIPAA breach, but when it happens a few specific things are set in motion.

Of course, depending on the type of breach, your employee who committed it will get disciplined. But I went over that in a previous video Before disciplining even happens, certain steps are set in motion.

LINKS:
____________________________________________

https://etactics.com/blog/hipaaviola...
____________________________________________

It could take days, weeks, months, or even years before an organization realizes a HIPAA violation happened. This is where cybersecurity technology and compliance processes are important. Both of these aspects are far enough along that it’s possible to know the moment a breach occurs.

Unfortunately, not every organization has both of those factors put in place still...in 2020….buttt that’s a story for a different time. When a HIPAA breach occurs, three phases happen afterward; Investigation, Correction and Notification (if necessary).

First, during the investigation phase organization’s confirm the who, what, when, why, how, and how much” with persons involved, including persons who committed the alleged violation; persons who may have received PHI improperly; and other relevant witnesses. Confirm the nature and amount of the PHI that was accessed, used, or disclosed, and why they accessed or disclosed the PHI. Ensure there was no redisclosure and that there will be no further redisclosure.

Out of all of the phases after a HIPAA breach occurs, investigation happens most often. This is because it kicks everything off. Also, many times you’ll launch an breach investigation and find out that it wasn’t a breach, if this occurs...you’re in luck.

If the investigation phase proves that there was a breach that took place, it’s time for the second phase; correction. This step is sometimes referred to as the mitigation process. In other words, this step is where you actually fix or attempt to fix the HIPAA breach that occurred. Mitigation may include retrieving, deleting, or destroying improperly disclosed PHI; terminating access or changing passwords; remote wiping mobile devices; modifying policies or practices; warning recipients of potential penalties for further violations.

When it comes to HIPAA breaches, the sooner you correct the problem the less of a penalty you’ll face. Specifically, a covered entity may avoid HIPAA penalties if it did not act with willful neglect and corrects the problem within 30 days. Of course, you may not be able to avoid that fact that there was a leak in the boat. But you can ensure that it doesn’t continue to leak by patching up the hole by doing things like changing processes; implementing new safeguards; modifying policies; and training employees.

After you’ve made the necessary corrective action, the last step is the optional notification phase. This phase is only optional because its based on the severity of the attack. If a HIPAA breach affects 500 or more individuals, a covered entity must notify the Secretary of the Department of Health and Human Services of the breach without unreasonable delay and in no case later than 60 calendar days from the discovery of the breach. Failure to do so will likely constitute “willful neglect”, thereby triggering mandatory penalties if discovered.

But, if a HIPAA breach is this severe, the government isn’t the only group to notify. If the breach was caused by a business associate then they must notify the covered entity within 60 days after discovery so that the covered entity may provide the required notices to others.

Covered entities must also notify the affected individual or their personal representative without unreasonable delay but in no event longer than 60 days following discovery.

Furthermore, If the breach involves more than 500 persons in a state, the covered entity must also notify local media within 60 days of discovery. A covered entity is required to maintain documentation concerning its breach analysis and/or reporting for six years.

► Reach out to Etactics @ https://www.etactics.com

►Subscribe: https://rb.gy/pso1fq to learn more tips and tricks in healthcare, health IT, and cybersecurity.

►Find us on LinkedIn:   / etacticsinc  

►Find us on Facebook:   / etacticsinc