Third Party Breaches

Overview

In this assignment you will complete several exercises related to the U.S. Department of Health and Human Services Office for Civil Rights Breach Portal to help you understand the nature and extent of HIPAA violations and how those violations are resolved. You will document your readiness to address breach notification regulations by analyzing the requirements.

Instructions

I. Explore the U.S. Department of Health and Human Services Office for Civil Rights Breach Portal via the link in the Resources. This “wall of shame” lists breaches affecting 500 or more individuals. Download the data into Excel in a .csv file and sort the records to answer the following questions. (Note: Do not submit your Excel file; instead submit your answers to the questions as part of your paper).

1. In which year did all three of the largest breaches occur in? Explain why you think that is the case.
2. Explain what sort of breach the entity suffered. What does this tell us about the nature of threats to PHI?
3. How significant is the issue of stolen laptops as a cause of data breaches? Explain.

II. Penalties and Corrective actions. The “Wall of Shame” includes many interesting cases. For example, consider a specific case. Read the Press Release and Resolution Agreement about a 2011 Breach report at North Memorial Healthcare in Minnesota (link in the Resources). Address these questions in narrative format:

1. What was the fundamental issue/cause of this settlement/case? Explain in detail.
2. What step could have prevented this incident from occurring and what issues where overlooked? Explain the role of the covered entity and business associate in this case.
3. Briefly describe the Corrective Plan of Action that was agreed upon in the settlement.

III. Breach Notification Requirements. Document your readiness to prepare Notice of Breach notifications to individuals who may be impacted by a security breach.

1. HIPAA requires three types of reports be filed (individual, media, and the Secretary of HHS). Describe each of these notifications in one or two paragraphs.
2. Explain what obligations a covered entity (CE) has in regards to its business associate(s) that may have suffered a data breach? Conversely, what obligations does the business associate have to its covered entity if it (the business associate) suspects it has suffered a breach?

Resources

• Addressing Third-Party Breaches Scoring Guide.
• APA Style and Format.
• U.S. Department of Health and Human Services Office for Civil Rights Breach Portal.
• Press Release and Resolution Agreement.
• Guidance to Render Unsecured Protected Health Information Unusable, Unreadable, or Indecipherable to Unauthorized Individuals.
• Model Notice of Privacy Practices.
• Breach Notification Rule