CHPC Study Group

Patrick...I'll take a crack at this...please let me know your feedback

An employee sends an unencrypted email that contains PHI to an outside agency.  The specifics are, that your company and the agency have a BAA in place, the receiver of the email has a need to know to coordinate healthcare for the patient.  Per the Security Rule, PHI needs to be protected (encrypted) in transmission,

...is this a breach?
I say yes given that it is an impermissible disclosure given that the transmission is not protected as is required by the regulations (or internal policy).  Therefore, it is presumed to be a breach and one can either assess and take action depending on the conclusion or one can simply move forward with the required notifications (remember DoD + 60)

an impermissible disclosure...
Of the four impressibles, I would categorize this as an example of an impermissible disclosure

or nothing but lack of judgement and concentration by the employee for not encrypting the email.
No...if policy, training and education, and other efforts are aimed at people sending PHI accurately and in a secured manner, you also have a violation of internal policies and procedures...which also makes this an impermissible disclosure and takes you down the presumed breach road.

BONUS...breach assessment
Factor 1: Yes/High
Factor 2: Yes/High
Factor 3: Low
Factor 4: Low
Conclusion: This impermissible disclosure does not represent where there is more than a low probability of compromise of the security or privacy of the PHI....assessment conclusion...NO BREACH.

Someone might ask how can I conclude Factor 4 to be low...good question...let's see what some people may have to offer along those lines.

Thoughts?

Patrick...I'll take a crack at this...please let me know your feedback

An employee sends an unencrypted email that contains PHI to an outside agency.  The specifics are, that your company and the agency have a BAA in place, the receiver of the email has a need to know to coordinate healthcare for the patient.  Per the Security Rule, PHI needs to be protected (encrypted) in transmission,

...is this a breach?
I say yes given that it is an impermissible disclosure given that the transmission is not protected as is required by the regulations (or internal policy).  Therefore, it is presumed to be a breach and one can either assess and take action depending on the conclusion or one can simply move forward with the required notifications (remember DoD + 60)

an impermissible disclosure...
Of the four impressibles, I would categorize this as an example of an impermissible disclosure

or nothing but lack of judgement and concentration by the employee for not encrypting the email.
No...if policy, training and education, and other efforts are aimed at people sending PHI accurately and in a secured manner, you also have a violation of internal policies and procedures...which also makes this an impermissible disclosure and takes you down the presumed breach road.

BONUS...breach assessment
Factor 1: Yes/High
Factor 2: Yes/High
Factor 3: Low
Factor 4: Low
Conclusion: This impermissible disclosure does not represent where there is more than a low probability of compromise of the security or privacy of the PHI....assessment conclusion...NO BREACH.

Someone might ask how can I conclude Factor 4 to be low...good question...let's see what some people may have to offer along those lines.

Thoughts?

Patrick...I'll take a crack at this...please let me know your feedback

An employee sends an unencrypted email that contains PHI to an outside agency.  The specifics are, that your company and the agency have a BAA in place, the receiver of the email has a need to know to coordinate healthcare for the patient.  Per the Security Rule, PHI needs to be protected (encrypted) in transmission,

...is this a breach?
I say yes given that it is an impermissible disclosure given that the transmission is not protected as is required by the regulations (or internal policy).  Therefore, it is presumed to be a breach and one can either assess and take action depending on the conclusion or one can simply move forward with the required notifications (remember DoD + 60)

an impermissible disclosure...
Of the four impressibles, I would categorize this as an example of an impermissible disclosure

or nothing but lack of judgement and concentration by the employee for not encrypting the email.
No...if policy, training and education, and other efforts are aimed at people sending PHI accurately and in a secured manner, you also have a violation of internal policies and procedures...which also makes this an impermissible disclosure and takes you down the presumed breach road.

BONUS...breach assessment
Factor 1: Yes/High
Factor 2: Yes/High
Factor 3: Low
Factor 4: Low
Conclusion: This impermissible disclosure does not represent where there is more than a low probability of compromise of the security or privacy of the PHI....assessment conclusion...NO BREACH.

Someone might ask how can I conclude Factor 4 to be low...good question...let's see what some people may have to offer along those lines.

Thoughts?

Patrick...I'll take a crack at this...please let me know your feedback

An employee sends an unencrypted email that contains PHI to an outside agency.  The specifics are, that your company and the agency have a BAA in place, the receiver of the email has a need to know to coordinate healthcare for the patient.  Per the Security Rule, PHI needs to be protected (encrypted) in transmission,

...is this a breach?
I say yes given that it is an impermissible disclosure given that the transmission is not protected as is required by the regulations (or internal policy).  Therefore, it is presumed to be a breach and one can either assess and take action depending on the conclusion or one can simply move forward with the required notifications (remember DoD + 60)

an impermissible disclosure...
Of the four impressibles, I would categorize this as an example of an impermissible disclosure

or nothing but lack of judgement and concentration by the employee for not encrypting the email.
No...if policy, training and education, and other efforts are aimed at people sending PHI accurately and in a secured manner, you also have a violation of internal policies and procedures...which also makes this an impermissible disclosure and takes you down the presumed breach road.

BONUS...breach assessment
Factor 1: Yes/High
Factor 2: Yes/High
Factor 3: Low
Factor 4: Low
Conclusion: This impermissible disclosure does not represent where there is more than a low probability of compromise of the security or privacy of the PHI....assessment conclusion...NO BREACH.

Someone might ask how can I conclude Factor 4 to be low...good question...let's see what some people may have to offer along those lines.

Thoughts?

Patrick...I'll take a crack at this...please let me know your feedback

An employee sends an unencrypted email that contains PHI to an outside agency.  The specifics are, that your company and the agency have a BAA in place, the receiver of the email has a need to know to coordinate healthcare for the patient.  Per the Security Rule, PHI needs to be protected (encrypted) in transmission,

...is this a breach?
I say yes given that it is an impermissible disclosure given that the transmission is not protected as is required by the regulations (or internal policy).  Therefore, it is presumed to be a breach and one can either assess and take action depending on the conclusion or one can simply move forward with the required notifications (remember DoD + 60)

an impermissible disclosure...
Of the four impressibles, I would categorize this as an example of an impermissible disclosure

or nothing but lack of judgement and concentration by the employee for not encrypting the email.
No...if policy, training and education, and other efforts are aimed at people sending PHI accurately and in a secured manner, you also have a violation of internal policies and procedures...which also makes this an impermissible disclosure and takes you down the presumed breach road.

BONUS...breach assessment
Factor 1: Yes/High
Factor 2: Yes/High
Factor 3: Low
Factor 4: Low
Conclusion: This impermissible disclosure does not represent where there is more than a low probability of compromise of the security or privacy of the PHI....assessment conclusion...NO BREACH.

Someone might ask how can I conclude Factor 4 to be low...good question...let's see what some people may have to offer along those lines.

Thoughts?