Healthcare IT Update

Include this information as part of your risk analysis.

Knowing what doesn’t count as a breach under new HIPAA notification rules can help you weigh whether to report a disclosure of unsecured protected health information. The rules include four exceptions, as follows:

Exception No. 1. An unintended acquisition, access or use of PHI by a person with authority to handle PHI who is acting in good faith. Also, “there’s no further acquisition, access or use of the PHI,” says attorney Kathryn Solley, with Atlanta law firm Seyfarth Shaw LLP.

Example: A nurse handed a doctor the wrong patient folder but immediately retrieved it, or the doctor returned the folder unused.

Exception No. 2. An inadvertent breach where a nurse, for example, gives another nurse information that the second nurse shouldn’t have, but there’s no reasonable risk of further use or misuse of the…