If you find yourself in the midst of a HIPAA breach, your first instinct might be to panic, but you need not. While a security breach of any kind is a high stress event, keeping cool headed and following tried and true HIPPA breach recovery protocols will help you avoid further trouble down the line.

Step One: Understanding a HIPPA Breach

What defines a HIPPA breach? Any release of information protected under HIPAA that violates the protection standard set forth by the rule. When you think of a breach you probably think of massive security breaches that result in thousands of records being released into the wrong hands — but sometimes breaches occur on a much smaller scale. Just because they only impact one or two patients doesn’t mean they should be regarded with less weight than a numerically larger one.

A textbook example would be mailing test results to the wrong patient or giving someone another patient’s after visit summary at a doctor’s appointment. These things might seem like laughable accidents, but in the wrong hands patient information can quickly become a hotbed of identity theft potential. No breach should be regarded as insignificant.

Step Two: Assess

The first step after any suspected HIPAA breach is to assess how much information was impacted and compare it to national reporting standards. Typically, if more than 500 patient records are involved, you must notify the public that a breach has occurred. Generally speaking, regardless of the size of the breach — or even the confirmation that a breach has occurred — there must be internal notification up the chain of command within the hospital system itself, usually facilitated by the hospital’s privacy officer (who may or may not be affiliated with the health information department).

Step Three: Notification

In instances where there are clearly identified patients involved, you should begin the process of notifying them via an official letter from your organization without delay. Generally speaking you are allowed 60 days after the breach to make your notifications, but the process should begin as soon as you’ve discovered it. This letter should inform the patient of what occurred, what’s being done by the hospital to rectify it and what the patient should do to protect themselves.

It would be in your hospital’s best interest to offer help wherever you can, particularly in the form of offering the patient something like credit monitoring in order to help reduce the likelihood that your mistake will negatively impact their lives. For any breach involving less than 500 people, you still need to notify DHHS annually.

Step Four: Reassess your liability and take action

If you haven’t purchased regulatory liability insurance, don’t wait. Most plans will cover HIPAA breaches as well as other issues related to compliance, intentional or not. For staff, the intent of the breach (wittingly or unwittingly) will determine in large part the type of disciplinary action they receive.

For example, if a nurse knows that she isn’t supposed to go snooping in her neighbor’s medical record since she isn’t that person’s nurse, but does it anyway, that would warrant disciplinary action far more severe than if a nurse stumbled into the wrong record because she used the wrong birth date and got into a record of a different “Jane Smith” – only to realize her error and report it immediately. Penalties can range anywhere from a few hundred dollars to a few hundred thousand dollars, depending on the nature and size. There are both federal and state penalties, so combining both could be a hefty set of fines for any hospital that’s experienced a breach.

Step Five: Reevaluate your policies and debrief

Since you’ve properly documented the entire process (right?) you can now assess the event from a bird’s eye view with your privacy officer and other pertinent staff members to uncover why the breach occurred and what could have prevented it, if anything.

If you find that there was a flaw, say, in your EMR steps should be taken immediately to patch it. If there are personnel issues, disciplinary action should be taken and in some cases, if there have been multiple offenses, an employee may need to be terminated. If you have experienced a few breaches rather close together, you should be looking to see if there are any patterns or common denominators in the events that could lead you to a culprit.

Most importantly, remember to keep all documentation around the breach and its aftermath for six years after the event occurs. Not only will the records be of value to you in the event of a lawsuit, but as previously mentioned, if there are future breaches you may want to come back to a particular event that seemed somewhat similar and see if you can establish a pattern or link between them.

Knowledge is power, as they say, and when it comes to patient data breaches understanding the why and the how is just as important — if not more so — than the who!