History of Elder AbusePreview
Open in TheBrain

Small Breach Exceptions

Small Breach Exceptions in HIPAA

The Health Insurance Portability and Accountability Act (HIPAA) includes provisions that protect the privacy and security of individuals' protected health information (PHI). However, HIPAA also recognizes that not all breaches of PHI pose the same level of risk to individuals. Therefore, it provides exceptions for certain small breaches that do not require notification or reporting to affected individuals, the Department of Health and Human Services (HHS), or the media.

Definition of a Small Breach

A small breach, also known as a "de minimis" breach under HIPAA, refers to an unauthorized acquisition, access, use, or disclosure of PHI that compromises the security or privacy of the individual's information. However, the breach is considered small if the covered entity or business associate determines that there is a low probability that the PHI has been compromised.

Four Criteria for Small Breach Exceptions

To qualify for a small breach exception, the breach must meet all of the following criteria:

  1. Unauthorized acquisition, access, use, or disclosure - The breach must involve the unauthorized acquisition, access, use, or disclosure of PHI. This means that the breach must involve PHI that was not intended to be accessed or disclosed by the individual or entity responsible for its protection.
  1. Limited data set and incidental disclosures - The breach must involve a limited data set or incidental disclosures. A limited data set is a subset of PHI that excludes certain direct identifiers. Incidental disclosures refer to situations where PHI is disclosed unintentionally, without the ability to reasonably prevent it.
  1. Determining low probability of compromise - The covered entity or business associate must conduct a risk assessment to determine if there is a low probability that the PHI has been compromised. Factors considered in the risk assessment include the nature and extent of the PHI involved, the identity of the unauthorized person who accessed or received the PHI, whether the PHI was actually acquired or viewed, and the extent to which the risk to the PHI has been mitigated.
  1. Implementation of safeguards - The covered entity or business associate must have implemented appropriate safeguards to protect the PHI. This includes having policies and procedures in place to prevent and detect breaches, as well as training employees on the importance of safeguarding PHI.

Notification Requirements for Small Breach Exceptions

If a breach meets all of the above criteria for a small breach exception, the covered entity or business associate is not required to provide notification to affected individuals or report the breach to HHS or the media. However, the covered entity or business associate must document the breach and the rationale for determining that there is a low probability of compromise.

Benefits and Considerations

The small breach exceptions in HIPAA provide some flexibility for covered entities and business associates when dealing with breaches of PHI. By exempting certain small breaches from the notification and reporting requirements, resources can be focused on addressing breaches that pose a higher risk to individuals' privacy and security.

However, it is important for covered entities and business associates to carefully assess breaches and determine if they meet the criteria for a small breach exception. This requires conducting a thorough risk assessment and documenting the rationale for the determination. Failure to accurately assess breaches can lead to non-compliance with HIPAA regulations and potential penalties.

Overall, the small breach exceptions in HIPAA strike a balance between protecting individuals' privacy and security while recognizing that not all breaches pose the same level of risk. By implementing appropriate safeguards and conducting thorough risk assessments, covered entities and business associates can effectively manage small breaches and focus their efforts on mitigating larger breaches that may have a greater impact on individuals.