We’ve Had A Breach – Now What? Garfunkel Wild, P.C. 411 Hackensack Avenue 6 th Floor Hackensack, New Jersey Broadway Albany, New York Great Neck Road Suite 600 Great Neck, New York Bedford Street Suite 406A Stamford, Connecticut Andrew E. Blustein, Esq. (516) (201) (203)

2© 2015 GARFUNKEL WILD, P.C. Breach Notification Under HITECH, a Covered Entity (“CE”) is required to NOTIFY patients of Breaches of unsecured protected health information. Under HITECH, a Covered Entity (“CE”) is required to NOTIFY patients of Breaches of unsecured protected health information. In addition, a CE must inform the Office of Civil Rights (“OCR”) of such Breaches either in an annual report or, if such Breaches involve more than 500 people, immediately in writing. In addition, a CE must inform the Office of Civil Rights (“OCR”) of such Breaches either in an annual report or, if such Breaches involve more than 500 people, immediately in writing. Note: Breaches involving more than 500 people will be posted on the Department of Health and Human Services’ websiteNote: Breaches involving more than 500 people will be posted on the Department of Health and Human Services’ website If such Breaches involve less than 500 people, CEs must inform OCR of such breaches in an annual report If such Breaches involve less than 500 people, CEs must inform OCR of such breaches in an annual report

3© 2015 GARFUNKEL WILD, P.C. Breach Definition A Breach is an unauthorized access, use or disclosure of unsecured PHI that compromises the unsecured PHI. A Breach is an unauthorized access, use or disclosure of unsecured PHI that compromises the unsecured PHI. An unauthorized access, use or disclosure of unsecured PHI is considered to be a Breach unless the Covered Entity can demonstrate, through a written risk assessment, that there was a low probability that the information was compromised. An unauthorized access, use or disclosure of unsecured PHI is considered to be a Breach unless the Covered Entity can demonstrate, through a written risk assessment, that there was a low probability that the information was compromised.

4© 2015 GARFUNKEL WILD, P.C. Breach Notification When a potential Breach is identified it must be investigated to determine the cause and extent of breach. When a potential Breach is identified it must be investigated to determine the cause and extent of breach. Consider opportunities to mitigate. Consider opportunities to mitigate.

5© 2015 GARFUNKEL WILD, P.C. Breach Notification A CE must send written notification to affected individuals by first-class mail without unreasonable delay and in no case later than 60 calendar days after the Breach is discovered by the CE. A CE must send written notification to affected individuals by first-class mail without unreasonable delay and in no case later than 60 calendar days after the Breach is discovered by the CE. A Breach is considered to be discovered when the incident becomes known (or should have become known with reasonable diligence), not when the CE concludes the investigation. A Breach is considered to be discovered when the incident becomes known (or should have become known with reasonable diligence), not when the CE concludes the investigation.

6© 2015 GARFUNKEL WILD, P.C. Content of Notice The notice to the affected patients must include at least the following : The notice to the affected patients must include at least the following : A brief description of what happened (e.g., date of the breach, date of the discovery of the breach)A brief description of what happened (e.g., date of the breach, date of the discovery of the breach) A description of the types of unsecured PHI that were involved in the breachA description of the types of unsecured PHI that were involved in the breach Any steps individuals should take to protect themselves from potential harm resulting from the breachAny steps individuals should take to protect themselves from potential harm resulting from the breach A brief description of what the CE involved is doing to investigate the breach, to mitigate the harm and to protect against any further breachesA brief description of what the CE involved is doing to investigate the breach, to mitigate the harm and to protect against any further breaches Contact procedures for individuals to ask questions or learn additional information (i.e., toll free telephone number which must remain active for at least 90 days)Contact procedures for individuals to ask questions or learn additional information (i.e., toll free telephone number which must remain active for at least 90 days) Note: Also need to comply with applicable state laws Note: Also need to comply with applicable state laws

7© 2015 GARFUNKEL WILD, P.C. HITECH Act Substitute Notice If there is insufficient contact information for some of the affected individuals or some notifications are returned undeliverable, the CE must provide substitute notice for the unreachable individuals (e.g., if greater than 10 individuals, conspicuous notice on the home page of the CE’s website for at least 90 days or conspicuous notice in prominent media outlets serving the State or jurisdiction where most of the affected individuals reside)

Breaches Involving 500 or More Individuals If there is a breach involving more than 500 individuals, in addition to providing direct notification to the affected individuals, the CE must also post notification of the Breach on the home page of its website and, through a press release, inform prominent media outlets serving the State or jurisdiction where individuals affected likely reside. Such notifications must include the same information required for the individual notice © 2013 GARFUNKEL WILD, P.C.

9© 2015 GARFUNKEL WILD, P.C. Mitigation Consider opportunities to mitigate Consider opportunities to mitigate Obtain written assurances that person who received information deleted it and didn’t share itObtain written assurances that person who received information deleted it and didn’t share it Offer credit monitoring servicesOffer credit monitoring services Take appropriate disciplinary action against employeesTake appropriate disciplinary action against employees Retrain staffRetrain staff Modify processes and implement new safeguards to prevent future breaches (e.g. fax numbers on speed dial, encrypted CDs, laptops, and thumb drives)Modify processes and implement new safeguards to prevent future breaches (e.g. fax numbers on speed dial, encrypted CDs, laptops, and thumb drives) Conduct additional audits on employeesConduct additional audits on employees

10© 2015 GARFUNKEL WILD, P.C. Risk Assessment If a CE determines that a Breach has not occurred, the CE must document a risk assessment If a CE determines that a Breach has not occurred, the CE must document a risk assessment Risk assessments should be documented when breach occurred as well (not required but OCR may ask for this documentation)Risk assessments should be documented when breach occurred as well (not required but OCR may ask for this documentation) The burden of demonstrating that no notice is required for a given Breach is on the CE The burden of demonstrating that no notice is required for a given Breach is on the CE