# Breach Notification for Unsecured Protected Health Information

> Briefs, arguments, decisions, and more.

URL: https://www.frixlaw.com/law-library/documents/fr%3AE9-20169

## Record

- **Collection:** Federal Register
- **Document type:** Rule
- **Published:** August 24, 2009
- **Citation:** 74 FR 42740

## Text

DEPARTMENT OF HEALTH AND HUMAN SERVICES
Office of the Secretary
45 CFR Parts 160 and 164
RIN 0991-AB56
Breach Notification for Unsecured Protected Health Information

AGENCY:

Office for Civil Rights, Department of Health and Human Services.

ACTION:

Interim final rule with request for comments.

SUMMARY:

The Department of Health and Human Services (HHS) is issuing this interim final rule with a request for comments to require notification of breaches of unsecured protected health information. Section 13402 of the Health Information Technology for Economic and Clinical Health (HITECH) Act, part of the American Recovery and Reinvestment Act of 2009 (ARRA) that was enacted on February 17, 2009, requires HHS to issue interim final regulations within 180 days to require covered entities under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and their business associates to provide notification in the case of breaches of unsecured protected health information. For purposes of determining what information is “unsecured protected health information,” in this document HHS is also issuing an update to its guidance specifying the technologies and methodologies that render protected health information unusable, unreadable, or indecipherable to unauthorized individuals.

DATES:

Effective Date:
This interim final rule is effective September 23, 2009.

Comment Date:
Comments on the provisions of this interim final rule are due on or before October 23, 2009. Comments on the information collection requirements associated with this rule are due on or before September 8, 2009.

ADDRESSES:

You may submit comments, identified by RIN 0991-AB56, by any of the following methods (please do not submit duplicate comments):

•
Federal eRulemaking Portal: http://www.regulations.gov.
Follow the instructions for submitting comments. Attachments should be in Microsoft Word, WordPerfect, or Excel; however, we prefer Microsoft Word.

•
Regular, Express, or Overnight Mail:
U.S. Department of Health and Human Services, Office for Civil Rights, Attention: HITECH Breach Notification, Hubert H. Humphrey Building, Room 509F, 200 Independence Avenue, SW., Washington, DC 20201. Please submit one original and two copies.

•
Hand Delivery or Courier:
Office for Civil Rights, Attention: HITECH Breach Notification, Hubert H. Humphrey Building, Room 509F, 200 Independence Avenue, SW., Washington, DC 20201. Please submit one original and two copies. (Because access to the interior of the Hubert H. Humphrey Building is not readily available to persons without federal government identification, commenters are encouraged to leave their comments in the mail drop slots located in the main lobby of the building.)

Inspection of Public Comments:
All comments received before the close of the comment period will be available for public inspection, including any personally identifiable or confidential business information that is included in a comment. We will post all comments received before the close of the comment period at
http://www.regulations.gov.
Because comments will be made public, they should not include any sensitive personal information, such as a person's social security number; date of birth; driver's license number, state identification number or foreign country equivalent; passport number; financial account number; or credit or debit card number. Comments also should not include any sensitive health information, such as medical records or other individually identifiable health information.

Docket:
For access to the docket to read background documents or comments received, go to
http://www.regulations.gov
or U.S. Department of Health and Human Services, Office for Civil Rights, 200 Independence Avenue, SW., Washington, DC 20201 (call ahead to the contact listed below to arrange for inspection).

FOR FURTHER INFORMATION CONTACT:

Andra Wicks, 202-205-2292.

SUPPLEMENTARY INFORMATION:

I. Background

The Health Information Technology for Economic and Clinical Health (HITECH) Act, Title XIII of Division A and Title IV of Division B of the American Recovery and Reinvestment Act of 2009 (ARRA) (Pub. L. 111-5), was enacted on February 17, 2009. Subtitle D of Division A of the HITECH Act (the Act), entitled “Privacy,” among other provisions, requires the Department of Health and Human Services (HHS or the Department) to issue interim final regulations for breach notification by covered entities subject to the Administrative Simplification provisions of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Pub. L. 104-191) and their business associates.

These breach notification provisions are found in section 13402 of the Act and apply to HIPAA covered entities and their business associates that access, maintain, retain, modify, record, store, destroy, or otherwise hold, use, or disclose unsecured protected health information. The Act incorporates the definitions of “covered entity,” “business associate,” and “protected health information” used in the HIPAA Administrative Simplification regulations (45 CFR parts 160, 162, and 164) (HIPAA Rules) at § 160.103. Under the HIPAA Rules, a covered entity is a health plan, health care clearinghouse, or health care provider that transmits any health information electronically in connection with a covered transaction, such as submitting health care claims to a health plan. Business associate, as defined in the HIPAA Rules, means a person who performs functions or activities on behalf of, or certain services for, a covered entity that involve the use or disclosure of individually identifiable health information. Examples of business associates include third party administrators or pharmacy benefit managers for health plans, claims processing or billing companies, transcription companies, and persons who perform legal, actuarial, accounting, management, or administrative services for covered entities and who require access to protected health information. The HIPAA Rules define “protected health information” as the individually identifiable health information held or transmitted in any form or medium by these HIPAA covered entities and business associates, subject to certain limited exceptions.

The Act requires HIPAA covered entities to provide notification to affected individuals and to the Secretary of HHS following the discovery of a breach of unsecured protected health information. In addition, in some cases, the Act requires covered entities to provide notification to the media of breaches. In the case of a breach of unsecured protected health information at or by a business associate of a covered entity, the Act requires the business associate to notify the covered entity of the breach. Finally, the Act requires the Secretary to post on an HHS Web site a list of covered entities that experience breaches of unsecured protected health information involving more than 500 individuals.

Section 13400(1) of the Act defines “breach” to mean, generally, the unauthorized acquisition, access, use, or disclosure of protected health information which compromises the security or privacy of such information. The Act provides exceptions to this definition to encompass disclosures where the recipient of the information would not reasonably have been able to retain the information, certain unintentional acquisition, access, or use of information by employees or persons acting under the authority of a covered entity or business associate, as well as certain inadvertent disclosures among persons similarly authorized to access protected health information at a business associate or covered entity.

Further, section 13402(h) of the Act defines “unsecured protected health information” as “protected health information that is not secured through the use of a technology or methodology specified by the Secretary in guidance” and provides that the guidance specify the technologies and methodologies that render protected health information unusable, unreadable, or indecipherable to unauthorized individuals. Covered entities and business associates that implement the specified technologies and methodologies with respect to protected health information are not required to provide notifications in the event of a breach of such information—that is, the information is not considered “unsecured” in such cases. As required by the Act, the Secretary initially issued this guidance on April 17, 2009 (it was subsequently published in the
Federal Register
at 74 FR 19006 on April 27, 2009). The guidance listed and described encryption and destruction as the two technologies and methodologies for rendering protected health information unusable, unreadable, or indecipherable to unauthorized individuals.

In cases in which notification is required, the Act at section 13402 prescribes the timeliness, content, and methods of providing the breach notifications. We discuss these and the above statutory provisions in more detail below where we describe section-by-section how these new regulations implement the breach notification provisions at section 13402 of the Act.

In addition to the breach notification provisions for HIPAA covered entities and business associates at section 13402, section 13407 of the Act, which is to be implemented and enforced by the Federal Trade Commission (FTC), imposes similar breach notification requirements upon vendors of personal health records (PHRs) and their third party service providers following the discovery of a breach of security of unsecured PHR identifiable health information.
1

As with the definition of “unsecured protected health information,” the provisions at section 13407(f)(3) define “unsecured PHR identifiable health information” as PHR identifiable health information that is not protected through the use of a technology or methodology specified by the Secretary of HHS in guidance. Thus, entities subject to the FTC breach notification rules must also use the Secretary's guidance to determine whether the information subject to a breach was “unsecured” and, therefore, whether breach notification is required.

1
The FTC issued a notice of proposed rulemaking to implement section 13407 of the Act on April 20, 2009 (74 FR 17914).

When HHS issued the guidance, HHS also published in the same document a request for information (RFI), inviting public comment both on the guidance itself, as well as on the breach provisions of section 13402 of the Act generally. After considering the public comment, we are issuing an updated version of the guidance in Section II below. In addition, we discuss public comment received on the Act's breach notification provisions where relevant below in the section-by-section description of the interim final rule.

We have concluded that we have good cause, under 5 U.S.C. 553(b)(B), to waive the notice-and-comment requirements of the Administrative Procedure Act and to proceed with this interim final rule. Section 13402(j) explicitly required us to issue these regulations as “interim final regulations” and to do so within 180 days. Based on this statutory directive and limited time frame, we concluded that notice-and-comment rulemaking was impracticable and contrary to public policy. Nevertheless, we sought comments in the RFI referenced above and considered those comments when drafting this rule. In addition, we provide the public with a 60-day period following publication of this document to submit comments on the interim final rule.

II. Guidance Specifying the Technologies and Methodologies That Render Protected Health Information Unusable, Unreadable, or Indecipherable to Unauthorized Individuals

A. Background

As discussed above, section 13402 of the Act requires breach notification following the discovery of a breach of unsecured protected health information. Section 13402(h) of the Act defines “unsecured protected health information” as “protected health information that is not secured through the use of a technology or methodology specified by the Secretary in guidance” and requires the Secretary to specify in the guidance the technologies and methodologies that render protected health information unusable, unreadable, or indecipherable to unauthorized individuals. As required by the Act, this guidance was issued on April 17, 2009, and later published in the
Federal Register
on April 27, 2009 (74 FR 19006). The guidance specified encryption and destruction as the technologies and methodologies for rendering protected health information, as well as PHR identifiable health information under section 13407 of the Act and the FTC's implementing regulation, unusable, unreadable, or indecipherable to unauthorized individuals such that breach notification is not required. The RFI asked for general comment on this guidance as well as for specific comment on the technologies and methodologies to render protected health information unusable, unreadable, or indecipherable to unauthorized individuals.

Many commenters expressed concern and confusion regarding the purpose of the guidance and its impact on a covered entity's responsibilities under the HIPAA Security Rule (45 CFR part 164, subparts A and C). We emphasize that this guidance does nothing to modify a covered entity's responsibilities with respect to the Security Rule nor does it impose any new requirements upon covered entities to encrypt all protected health information. The Security Rule requires covered entities to safeguard electronic protected health information and permits covered entities to use any security measures that allow them to reasonably and appropriately implement all safeguard requirements. Under 45 CFR 164.312(a)(2)(iv) and (e)(2)(ii), a covered entity must consider implementing encryption as a method for safeguarding electronic protected health information; however, because these are addressable implementation specifications, a covered entity may be in compliance with the Security Rule even if it reasonably decides not to encrypt electronic protected health information and instead uses a comparable method to safeguard the information.

Therefore, if a covered entity chooses to encrypt protected health information to comply with the Security Rule, does so pursuant to this guidance, and subsequently discovers a breach of that

encrypted information, the covered entity will not be required to provide breach notification because the information is not considered “unsecured protected health information” as it has been rendered unusable, unreadable, or indecipherable to unauthorized individuals. On the other hand, if a covered entity has decided to use a method other than encryption or an encryption algorithm that is not specified in this guidance to safeguard protected health information, then although that covered entity may be in compliance with the Security Rule, following a breach of this information, the covered entity would have to provide breach notification to affected individuals. For example, a covered entity that has a large database of protected health information may choose, based on their risk assessment under the Security Rule, to rely on firewalls and other access controls to make the information inaccessible, as opposed to encrypting the information. While the Security Rule permits the use of firewalls and access controls as reasonable and appropriate safeguards, a covered entity that seeks to ensure breach notification is not required in the event of a breach of the information in the database would need to encrypt the information pursuant to the guidance.

We also received several comments asking for clarification and additional detail regarding the forms of information and the specific devices and protocols described in the guidance. As a result, we provide clarification regarding the forms of information addressed in the National Institute of Standards and Technology (NIST) publications referenced in the guidance. We clarify that “data in motion” includes data that is moving through a network, including wireless transmission, whether by e-mail or structured electronic interchange, while “data at rest” includes data that resides in databases, file systems, flash drives, memory, and any other structured storage method. “Data in use” includes data in the process of being created, retrieved, updated, or deleted, and “data disposed” includes discarded paper records or recycled electronic media.

Additionally, many commenters suggested that access controls be included in the guidance as a method for rendering protected health information unusable, unreadable, or indecipherable to unauthorized individuals. We recognize that access controls, as well as other security methods such as firewalls, are important tools for safeguarding protected health information. While we believe access controls may render information inaccessible to unauthorized individuals, we do not believe that access controls meet the statutory standard of rendering protected health information unusable, unreadable, or indecipherable to unauthorized individuals. If access controls are compromised, the underlying information may still be usable, readable, or decipherable to an unauthorized individual, and thus, constitute unsecured protected health information for which breach notification is required. Therefore, we have not included access controls in the guidance; however, we do emphasize the benefit of strong access controls, which may function to prevent breaches of unsecured protected health information from occurring in the first place.

Other commenters suggested that the guidance include redaction of paper records as an alternative to destruction. Because redaction is not a standardized methodology with proven capabilities to destroy or render the underlying information unusable, unreadable or indecipherable, we do not believe that redaction is an accepted alternative method to secure paper-based protected health information. Therefore, we have clarified in this guidance that only destruction of paper protected health information, and not redaction, will satisfy the requirements to relieve a covered entity or business associate from breach notification. We note, however, that covered entities and business associates may continue to create limited data sets or de-identify protected health information through redaction if the removal of identifiers results in the information satisfying the criteria of 45 CFR 164.514(e)(2) or 164.514(b), respectively. Further, a loss or theft of information that has been redacted appropriately may not require notification under these rules either because the information is not protected health information (as in the case of de-identified information) or because the unredacted information does not compromise the security or privacy of the information and thus, does not constitute a breach as described in Section IV below.

In response to comments received, we also make two additional clarifications in the guidance. First, for purposes of the guidance below and ensuring encryption keys are not breached, we clarify that covered entities and business associates should keep encryption keys on a separate device from the data that they encrypt or decrypt. Second, we also include in the guidance below a note regarding roadmap guidance activities on the part of the NIST pertaining to data storage on enterprise-level storage devices, such as RAID (redundant array of inexpensive disks), or SAN (storage-attached network) systems.

For ease of reference, we have published this updated guidance in this document below; however, it will also be available on the HHS Web site at
http://www.hhs.gov/ocr/privacy/.
Any further comments regarding this guidance received in response to the interim final rule will be addressed in the first annual update to the guidance, to be issued in April 2010.

B. Guidance Specifying the Technologies and Methodologies that Render Protected Health Information Unusable, Unreadable, or Indecipherable to Unauthorized Individuals

Protected health information (PHI) is rendered unusable, unreadable, or indecipherable to unauthorized individuals if one or more of the following applies:

(a) Electronic PHI has been encrypted as specified in the HIPAA Security Rule by “the use of an algorithmic process to transform data into a form in which there is a low probability of assigning meaning without use of a confidential process or key”
2

and such confidential process or key that might enable decryption has not been breached. To avoid a breach of the confidential process or key, these decryption tools should be stored on a device or at a location separate from the data they are used to encrypt or decrypt. The encryption processes identified below have been tested by the National Institute of Standards and Technology (NIST) and judged to meet this standard.

2
45 CFR 164.304, definition of “encryption.”

(i) Valid encryption processes for data at rest are consistent with NIST Special Publication 800-111,
Guide to Storage Encryption Technologies for End User Devices
.
3 4

3
NIST Roadmap plans include the development of security guidelines for enterprise-level storage devices, and such guidelines will be considered in updates to this guidance, when available.

4
Available at
http://www.csrc.nist.gov/.

(ii) Valid encryption processes for data in motion are those which comply, as appropriate, with NIST Special Publications 800-52,
Guidelines for the Selection and Use of Transport Layer Security (TLS) Implementations;
800-77,
Guide to IPsec VPNs;
or
800-113, Guide to SSL VPNs,
or others which are Federal Information Processing Standards (FIPS) 140-2 validated.
5

5
Available at
http://www.csrc.nist.gov/.

(b) The media on which the PHI is stored or recorded have been destroyed in one of the following ways:

(i) Paper, film, or other hard copy media have been shredded or destroyed such that the PHI cannot be read or otherwise cannot be reconstructed. Redaction is specifically excluded as a means of data destruction.

(ii) Electronic media have been cleared, purged, or destroyed consistent with NIST Special Publication 800-88,
Guidelines for Media Sanitization,
6

such that the PHI cannot be retrieved.

6
Available at
http://www.csrc.nist.gov/.

III. Overview of Interim Final Rule

We are adding a new subpart D to part 164 of title 45 of the Code of Federal Regulations (CFR) to implement the breach notification provisions in section 13402 of the Act. These provisions apply to HIPAA covered entities and their business associates and set forth the requirements for notification to affected individuals, the media, and the Secretary of HHS following a breach of unsecured protected health information. In drafting this interim final regulation, we considered the public comments received in response to the RFI described above.

In addition, we consulted closely with the FTC in the development of these regulations. Commenters in response to both the RFI as well as the FTC's notice of proposed rulemaking urged HHS and the FTC to work together to ensure that the regulated entities know with which rule they must comply and that those entities that are subject to both rules because they may operate in different roles are not subject to two completely different and inconsistent regulatory schemes. In addition, commenters were concerned that individuals could receive multiple notices of the same breach if the HHS and the FTC regulations overlapped. Thus, HHS coordinated with the FTC to ensure these issues were addressed in the respective rulemakings. First, the rules make clear that entities operating as HIPAA covered entities and business associates are subject to HHS', and not the FTC's, breach notification rule. Second, in those limited cases where an entity may be subject to both HHS' and the FTC's rules, such as a vendor that offers PHRs to customers of a HIPAA covered entity as a business associate and also offers PHRs directly to the public, we worked with the FTC to ensure both sets of regulations were harmonized by including the same or similar requirements, within the constraints of the statutory language. See
Section IV.F.
below for a more detailed discussion and an example of our harmonization efforts.

IV. Section-by-Section Description of Interim Final Rule

The following discussion describes the provisions of the interim final rule section by section. Those interested in commenting on the interim final rule can assist the Department by preceding discussion of any particular provision or topic with a citation to the section of the interim final rule being discussed.

A. Applicability—Section 164.400

Section 164.400 of the interim final rule provides that this breach notification rule is applicable to breaches occurring on or after 30 days from the date of publication of this interim final rule. See
Section IV.K. Effective/Compliance Date
of this rule for further discussion.

B. Definitions—Section 164.402

Section 164.402 of the interim final rule adopts definitions for the terms “breach” and “unsecured protected health information.”

1. Breach

Section 13402 of the Act and this interim final rule require covered entities and business associates to provide notification following a breach of unsecured protected health information. Section 13400(1)(A) of the Act defines “breach” as the “unauthorized acquisition, access, use, or disclosure of protected health information which compromises the security or privacy of the protected health information, except where an unauthorized person to whom such information is disclosed would not reasonably have been able to retain such information.” Section 13400(1)(B) of the Act provides several exceptions to the definition of “breach.” Based on section 13400(1)(A), we have defined “breach” at § 164.402 of the interim final rule as “the acquisition, access, use, or disclosure of protected health information in a manner not permitted under subpart E of this part which compromises the security or privacy of the protected health information.” We have added paragraph (1) to the definition to clarify when the security or privacy of information is considered to be compromised. Paragraph (2) of the definition then includes the statutory exceptions, including the exception within section 13400(1)(A) that refers to whether the recipient would reasonably have been able to retain the information.

Protected Health Information

We note that the definition of “breach” is limited to protected health information. With respect to a covered entity or business associate of a covered entity, protected health information is individually identifiable health information that is transmitted or maintained in any form or medium, including electronic information. 45 CFR 160.103. If information is de-identified in accordance with 45 CFR 164.514(b), it is not protected health information, and thus, any inadvertent or unauthorized use or disclosure of such information will not be considered a breach for purposes of this subpart. Additionally, § 160.103 excludes certain types of individually identifiable health information from the definition of “protected health information,” such as employment records held by a covered entity in its role as employer. If individually identifiable health information that is not protected health information is used or disclosed in an unauthorized manner, it would not qualify as a breach for purposes of this subpart—although the covered entity should consider whether it has notification requirements under other laws. Further, we note that although the definition of “breach” applies to protected health information generally, covered entities and business associates are required to provide the breach notifications required by the Act and this interim final rule (discussed below) only upon a breach of unsecured protected health information. See also Section II of this document for a list of the technologies and methodologies that render protected health information secure such that notification is not required in the event of a breach.

Unauthorized Acquisition, Access, Use, or Disclosure

The statute defines a “breach” as the “unauthorized” acquisition, access, use, or disclosure of protected health information. Several commenters asked that we define “unauthorized” or that we clarify its meaning. We clarify that “unauthorized” is an impermissible use or disclosure of protected health information under the HIPAA Privacy Rule (subpart E of 45 CFR part 164). Accordingly, the definition of “breach” at § 160.402 of the interim final rule interprets the “unauthorized acquisition, access, use, or disclosure of protected health information” as “the acquisition, access, use, or disclosure of protected health information in a manner not permitted under subpart E of this part.” We emphasize that not all violations of the Privacy Rule will be

breaches under this subpart, and therefore, covered entities and business associates need not provide breach notification in all cases of impermissible uses and disclosures. We also note that the HIPAA Security Rule provides for administrative, physical, and technical safeguards and organizational requirements for electronic protected health information, but does not govern uses and disclosures of protected health information. Accordingly, a violation of the Security Rule does not itself constitute a potential breach under this subpart, although such a violation may lead to a use or disclosure of protected health information that is not permitted under the Privacy Rule and thus, may potentially be a breach under this subpart.

The Act does not define the terms “acquisition” and “access.” Several commenters asked that we define or identify the differences between acquisition, access, use, and disclosure of protected health information, for purposes of the definition of “breach.” We interpret “acquisition” and “access” to information based on their plain meanings and believe that both terms are encompassed within the current definitions of “use” and “disclosure” in the HIPAA Rules. Accordingly, we have not added separate definitions for these terms. We have retained the statutory terms in the regulation in order to maintain consistency with the statute. In addition, we note that while the HIPAA Security Rule at § 164.304 includes a definition of the term “access,” such definition is limited to the ability to use “system resources” and not to access to information more generally and thus, we have revised that definition to make clear that it does not apply for purposes of these breach notification rules.

For an acquisition, access, use, or disclosure of protected health information to constitute a breach, it must constitute a violation of the Privacy Rule. Therefore, one of the first steps in determining whether notification is necessary under this subpart is to determine whether a use or disclosure violates the Privacy Rule. We note that uses or disclosures that impermissibly involve more than the minimum necessary information, in violation of §§ 164.502(b) and 164.514(d), may qualify as breaches under this subpart. In contrast, a use or disclosure of protected health information that is incident to an otherwise permissible use or disclosure and occurs despite reasonable safeguards and proper minimum necessary procedures would not be a violation of the Privacy Rule pursuant to 45 CFR 164.502(a)(1)(iii) and, therefore, would not qualify as a potential breach. Finally, violations of administrative requirements, such as a lack of reasonable safeguards or a lack of training, do not themselves qualify as potential breaches under this subpart (although such violations certainly may lead to impermissible uses or disclosures that qualify as breaches).

Compromises the Security or Privacy of Protected Health Information

The Act and regulation next limit the definition of “breach” to a use or disclosure that “compromises the security or privacy” of the protected health information. Accordingly, once it is established that a use or disclosure violates the Privacy Rule, the covered entity must determine whether the violation compromises the security or privacy of the protected health information.

For the purposes of the definition of “breach,” many commenters suggested that we add a harm threshold such that an unauthorized use or disclosure of protected health information is considered a breach only if the use or disclosure poses some harm to the individual. These commenters noted that the “compromises the security or privacy” language in section 13400(1)(A) of the Act contemplates that covered entities will perform some type of risk assessment to determine if there is a risk of harm to the individual, and therefore, if a breach has occurred. Commenters urged that the addition of a harm threshold to the definition would also align this regulation with many State breach notification laws that require entities to reach similar harm thresholds before providing notification. Finally, some commenters noted that failure to include a harm threshold for requiring breach notification may diminish the impact of notifications received by individuals, as individuals may be flooded with notifications for breaches that pose no threat to the security or privacy of their protected health information or, alternatively, may cause unwarranted panic in individuals, and the expenditure of undue costs and other resources by individuals in remedial action.

We agree that the statutory language encompasses a harm threshold and have clarified in paragraph (1) of the definition that “compromises the security or privacy of the protected health information” means “poses a significant risk of financial, reputational, or other harm to the individual.” This ensures better consistency and alignment with State breach notification laws, as well as existing obligations on Federal agencies (some of which also must comply with these rules as HIPAA covered entities) pursuant to OMB Memorandum M-07-16 to have in place breach notification policies for personally identifiable information that take into account the likely risk of harm caused by a breach in determining whether breach notification is required. Thus, to determine if an impermissible use or disclosure of protected health information constitutes a breach, covered entities and business associates will need to perform a risk assessment to determine if there is a significant risk of harm to the individual as a result of the impermissible use or disclosure. In performing the risk assessment, covered entities and business associates may need to consider a number or combination of factors, some of which are described below.
7

7
Covered entities may also wish to review OMB Memorandum M-07-16 for examples of the types of factors that may need to be taken into account in determining whether an impermissible use or disclosure presents a significant risk of harm to the individual.

Covered entities and business associates should consider who impermissibly used or to whom the information was impermissibly disclosed when evaluating the risk of harm to individuals. If, for example, protected health information is impermissibly disclosed to another entity governed by the HIPAA Privacy and Security Rules or to a Federal agency that is obligated to comply with the Privacy Act of 1974 (5 U.S.C. 552a) and the Federal Information Security Management Act of 2002 (44 U.S.C. 3541
et seq.
), there may be less risk of harm to the individual, since the recipient entity is obligated to protect the privacy and security of the information it received in the same or similar manner as the entity that disclosed the information. In contrast, if protected health information is impermissibly disclosed to any entity or person that does not have similar obligations to maintain the privacy and security of the information, the risk of harm to the individual is much greater.

We expect that there may be circumstances where a covered entity takes immediate steps to mitigate an impermissible use or disclosure, such as by obtaining the recipient's satisfactory assurances that the information will not be further used or disclosed (through a confidentiality agreement or similar means) or will be destroyed. If such steps eliminate or reduce the risk of harm to the individual to a less than “significant risk,” then we interpret that the security and privacy of the

information has not been compromised and, therefore, no breach has occurred.

In addition, there may be circumstances where impermissibly disclosed protected health information is returned prior to it being accessed for an improper purpose. For example, if a laptop is lost or stolen and then recovered, and a forensic analysis of the computer shows that its information was not opened, altered, transferred, or otherwise compromised, such a breach may not pose a significant risk of harm to the individuals whose information was on the laptop. Note, however, that if a computer is lost or stolen, we do not consider it reasonable to delay breach notification based on the hope that the computer will be recovered.

In performing a risk assessment, covered entities and business associates should also consider the type and amount of protected health information involved in the impermissible use or disclosure. If the nature of the protected health information does not pose a significant risk of financial, reputational, or other harm, then the violation is not a breach. For example, if a covered entity improperly discloses protected health information that merely included the name of an individual and the fact that he received services from a hospital, then this would constitute a violation of the Privacy Rule, but it may not constitute a significant risk of financial or reputational harm to the individual. In contrast, if the information indicates the type of services that the individual received (such as oncology services), that the individual received services from a specialized facility (such as a substance abuse treatment program
8

), or if the protected health information includes information that increases the risk of identity theft (such as a social security number, account number, or mother's maiden name), then there is a higher likelihood that the impermissible use or disclosure compromised the security and privacy of the information. The risk assessment should be fact specific, and the covered entity or business associate should keep in mind that many forms of health information, not just information about sexually transmitted diseases or mental health, should be considered sensitive for purposes of the risk of reputational harm—especially in light of fears about employment discrimination.

8
Note that an impermissible disclosure that indicates that an individual has received services from a substance abuse treatment program may also constitute a violation of 42 U.S.C. 290dd-2 and the implementing regulations at 42 CFR part 2. These provisions require the confidentiality of substance abuse patient records.

We also address impermissible uses and disclosures involving limited data sets (as the term is used at 45 CFR 164.514(e) of the Privacy Rule), in paragraph (1) of the definition of “breach” at § 164.402 of the interim final rule. In the RFI discussed above, we asked for public comment on whether limited data sets should be considered unusable, unreadable, or indecipherable and included as a methodology in the guidance. A limited data set is created by removing the 16 direct identifiers listed in § 164.514(e)(2) from the protected health information.
9

These direct identifiers include the name, address, social security number, and account number of an individual or the individual's relative, employer, or household member. When these 16 direct identifiers are removed from the protected health information, the information is not completely de-identified pursuant to 45 CFR 164.514(b). In particular, the elements of dates, such as dates of birth, and zip codes, are allowed to remain within the limited data set, which increase the potential for re-identification of the information. Because there is a risk of re-identification of the information within a limited data set, the Privacy Rule treats this information as protected health information that may only be used or disclosed as permitted by the Privacy Rule.

9
A limited data set is protected health information that excludes the following direct identifiers of the individual or of relatives, employers, or household members of the individual: (1) Names; (2) postal address information, other than town or city, State, and zip code; (3) telephone numbers; (4) fax numbers; (5) e-mail addresses; (6) social security numbers; (7) medical record numbers; (8) health plan beneficiary numbers; (9) account numbers; (10) certificate/license plate numbers; (11) vehicle identifiers and serial numbers; (12) device identifiers and serial numbers; (13) Web URLs; (14) Internet Protocol (IP) address numbers; (15) biometric identifiers, including finger and voice prints; and (16) full face photographic images and any comparable images.

Several commenters suggested that the limited data set should not be included in the guidance as a method to render protected health information unusable, unreadable, or indecipherable to unauthorized individuals such that breach notification is not required. These commenters cited concerns about the risk of re-identification of protected health information in a limited data set and noted that, as more data exists in electronic form and as more data becomes public, it will be easier to combine these various sources to re-establish the identity of the individual. Furthermore, due to the risk of re-identification, these commenters stated that creating a limited data set was not comparable to encrypting information, and therefore, should not be included as a method to render protected health information unusable, unreadable, or indecipherable to unauthorized individuals.

The majority of commenters, however, did support the inclusion of the limited data set in the guidance. These commenters stated that it would be impractical to require covered entities and business associates to notify individuals of a breach of information within a limited data set because, by definition, such information excludes the very identifiers that would enable covered entities and business associates, without undue burden, to identify the affected individuals and comply with the breach notification requirements. Additionally, these commenters cited contractual concerns regarding the data use agreement, which prohibits the recipient of a limited data set from re-identifying the information and therefore, may pose problems with complying with the notification requirements of section 13402(b) of the Act.

These commenters also noted that the decision to exclude the limited data set from the guidance, such that a breach of a limited data set would require breach notification, would reduce the likelihood that covered entities would continue to create and share limited data sets. This, in turn, would have a chilling effect on the research and public health communities, which rely on receiving information from covered entities in limited data set form.

Finally, commenters noted that the removal of the 16 direct identifiers in the limited data set presents a minimal risk of serious harm to the individual by limiting the possibility that the information could be used for an illicit purpose if breached. These commenters also suggested that the inclusion of the limited data set in the guidance would align with most state breach notification laws, which, as a general matter, only require notification when certain identifiers are exposed and when there is a likelihood that the breach will result in harm to the individual.

We also asked commenters if they believed that the removal of an individual's date of birth or zip code, in addition to the 16 direct identifiers in 45 CFR 164.514(e)(2), would reduce the risk of re-identification of the information such that it could be included in the guidance. Several commenters responded to this question. While some stated that the removal of these data elements would render the

information useless to the research and public health communities, which may, for example, require zip codes for many population based studies, many commenters did acknowledge that the removal of these additional identifiers would reduce the risk of re-identification of the information.

After considering these comments, we decided against including the limited data set in the guidance as a method for rendering protected health information unusable, unreadable, or indecipherable to unauthorized individuals due to the potential risk of re-identification of this information. However, we address breaches of limited data sets in the definition of “breach” as follows.

Under the definition of “breach” at § 164.402, in order to determine whether a covered entity's or business associate's impermissible use or disclosure of protected health information constitutes a breach, the covered entity or business associate will need to perform the risk assessment discussed above. This applies to impermissible uses or disclosures of protected health information that constitute a limited data set, unless, as discussed below, the protected health information also does not include zip codes or dates of birth. In performing the risk assessment to determine the likely risk of harm caused by an impermissible use or disclosure of a limited data set, the covered entity or business associate should take into consideration the risk of re-identification of the protected health information contained in the limited data set.

Through a risk assessment, a covered entity or business associate may determine that the risk of identifying a particular individual is so small that the use or disclosure poses no significant risk of harm to any individuals. For example, it may be determined that an impermissible use or disclosures of a limited data set that includes zip codes, based on the population features of those zip codes, does not create a significant risk that a particular individual can be identified. Therefore, there would be no significant risk of harm to the individual. If there is no significant risk of harm to the individual, then no breach has occurred and no notification is required. If, however, the covered entity or business associate determines that the individual can be identified based on the information disclosed, and there is otherwise a significant risk of harm to the individual, then breach notification is required, unless one of the other exceptions discussed below applies.

We have provided a narrow, explicit exception to what compromises the privacy or security of protected health information for a use or disclosure of protected health information that excludes the 16 direct identifiers listed at 45 CFR 164.514(e)(2) as well as dates of birth and zip codes. Thus, we deem an impermissible use or disclosure of this information to not compromise the security or privacy of the protected health information, because we believe that impermissible uses or disclosures of this information—if subjected to the type of risk assessment described above—would pose a low level of risk. We emphasize that this is a narrow exception. If, for example, the information does not contain birth dates but does contain zip code information or contains both birth dates and zip code information, then this narrow exception would not apply, and the covered entity or business associate would be required to perform a risk assessment to determine if the risk of re-identification poses a significant risk of harm to the individual. We invite comments on this narrow exception. We do not believe that this narrow exception will have the unintended consequence of discouraging the use of encryption and other methods for rendering protected health information unusable, unreadable, or indecipherable; however, we invite comments on this issue as well. Finally, we note that this narrow exception should not be construed as encouraging or permitting the use or disclosure of more than the minimum necessary information, in violation of §§ 164.502(b) and 164.514(d).

We do not intend to interfere with research or public health activities that rely on dates of birth or zip codes. Uses and disclosures of limited data sets that include this information continue to be permissible under the Privacy Rule if the applicable requirements, such as a data use agreement, are satisfied. Further, we note that a covered entity or business associate is not responsible for a breach by a third party to whom it permissibly disclosed protected health information, including limited data sets, unless the third party received the information in its role as an agent of the covered entity or business associate. To the extent that a third party recipient of the information is itself a covered entity, and the information is breached while at the third party (i.e., used or disclosed in an impermissible manner and in a manner determined to compromise the privacy or security of the information), then the third party will be responsible for complying with the provisions of this interim final rule. In cases where a covered entity is the recipient of a limited data set pursuant to § 164.514(e) of the Privacy Rule and it is unable to re-identify the individuals after a breach occurs, it may satisfy the requirements of § 164.404 without re-identifying the information, by providing substitute notice to the individuals as required by paragraph (d)(2) of that section.

We note that the discussion above regarding “limited data sets” applies to any protected health information that excludes the 16 direct identifiers listed at § 164.514(e)(2), regardless of whether the information is used for health care operations, public health, or research purposes (see § 164.514(e)(3)(i)), and is subject to a data use agreement under § 164.514(e) of the Privacy Rule. Thus, for example, a covered entity that impermissibly uses or discloses data that is stripped of the 16 direct identifiers described above, zip codes, and dates of birth, may take advantage of the exception to what is a breach, regardless of the intended purpose of the use or disclosure or whether a data use agreement was in place.

With respect to any type of protected health information, we note that § 164.414, discussed below, gives covered entities and business associates the burden of demonstrating that no breach has occurred because the impermissible use or disclosure did not pose a significant risk of harm to the individual. Covered entities and business associates must document their risk assessments, so that they can demonstrate, if necessary, that no breach notification was required following an impermissible use or disclosure of protected health information. For impermissible uses or disclosures of protected health information that fall under the narrow exception at paragraph (1)(ii) of this definition, which do not qualify as breaches because the protected health information is a limited data set that does not include zip codes or dates of birth, documentation that demonstrates that the lost information did not include these identifiers will suffice.

Exceptions to Breach

Section 13400(1) of the Act also includes three exceptions to the definition of “breach” that encompass situations Congress clearly intended to not constitute breaches: (1) Unintentional acquisition, access, or use of protected health information by an employee or individual acting under the authority of a covered entity or business associate (section 13400(1)(B)(i)); (2) inadvertent disclosure of protected health information from one person

authorized to access protected health information at a covered entity or business associate to another person authorized to access protected health information at the covered entity or business associate (section 13400(1)(B)(ii) and (iii)); and (3) unauthorized disclosures in which an unauthorized person to whom protected health information is disclosed would not reasonably have been able to retain the information (section 13400(1)(A)). We have included these three exceptions as paragraphs (2)(i), (ii), and (iii), respectively.

The first regulatory exception at paragraph (2)(i) of this definition, for unintentional acquisition, access, or use of protected health information, generally mirrors the exception in section 13400(1)(B)(i) of the Act. This statutory section excepts from the definition of “breach” the unintentional acquisition, access, or use of protected health information by an employee or individual acting under the authority of a covered entity or a business associate, if the acquisition, access, or use was made in good faith, within the course and scope of employment or other professional relationship, and does not result in further use or disclosure.

We modified the statutory language to use “workforce members” instead of employees. Workforce member is a defined term in 45 CFR 160.103 and means “employees, volunteers, trainees, and other persons whose conduct, in the performance of work for a covered entity, is under the direct control of such entity, whether or not they are paid by the covered entity.”

A person is acting under the authority of a covered entity or business associate if he or she is acting on its behalf. This may include a workforce member of a covered entity, an employee of a business associate, or even a business associate of a covered entity. Similarly, to determine whether the access, acquisition, or use was made “within the scope of authority,” the covered entity or business associate should consider whether the person was acting on its behalf at the time of the inadvertent acquisition, access, or use.

Additionally, while the statutory language provides that this exception applies where the recipient does not further use or disclose the information, we have interpreted this exception as encompassing circumstances where the recipient does not further use or disclose the information in a manner not permitted under the Privacy Rule. In circumstances where any further use or disclosure of the information is permissible under the Privacy Rule, we interpret that there is no breach because the security and privacy of the information has not been compromised by any such permissible use or disclosure.

To illustrate this exception, we offer the following example. A billing employee receives and opens an e-mail containing protected health information about a patient which a nurse mistakenly sent to the billing employee. The billing employee notices that he is not the intended recipient, alerts the nurse of the misdirected e-mail, and then deletes it. The billing employee unintentionally accessed protected health information to which he was not authorized to have access. However, the billing employee's use of the information was done in good faith and within the scope of authority, and therefore, would not constitute a breach and notification would not be required, provided the employee did not further use or disclose the information accessed in a manner not permitted by the Privacy Rule.

In contrast, a receptionist at a covered entity who is not authorized to access protected health information decides to look through patient files in order to learn of a friend's treatment. In this case, the impermissible access to protected health information would not fall within this exception to breach because such access was neither unintentional, done in good faith, nor within the scope of authority.

The second regulatory exception, at paragraph (2)(ii) of this definition, covers inadvertent disclosures and generally mirrors the exception provided in section 13400(1)(B)(ii) and (iii) of the Act, with slight modifications. The statute excepts from the definition of “breach” inadvertent disclosures from an individual who is otherwise authorized to access protected health information at a facility operated by a covered entity or business associate to another similarly situated individual at the same facility if the information is not further used or disclosed without authorization. We have modified the statutory language slightly to except from breach inadvertent disclosures of protected health information from a person who is authorized to access protected health information at a covered entity or business associate to another person authorized to access protected health information at the same covered entity, business associate, or organized health care arrangement in which the covered entity participates. Organized health care arrangement is defined by the HIPAA Rules to mean, among other things, a clinically integrated care setting in which individuals typically receive health care from more than one health care provider.
10

See 45 CFR 160.103. This includes, for example, a covered entity, such as a hospital, and the health care providers who have staff privileges at the hospital.

10
45 CFR 160.103 also defines “organized health care arrangement” to include “an organized system of health care in which more than one covered entity participates” and in which the participating covered entities engage in certain joint utilization review, quality assessment and improvement, or payment activities. In addition, the definition encompasses certain relationships between group health plans and health insurance issuers or health maintenance organizations (HMO), as well as relationships among group health plans which are maintained by the same plan sponsor.

We received several comments with respect to this exception, and many commenters asked that we clarify and explain the statutory language regarding what it means to be a “similarly situated individual” and what constitutes the “same facility” for purposes of this exception. We believe that a “similarly situated individual,” for purposes of the statute, means an individual who is authorized to access protected health information, and thus, for clarity, we have substituted this language for the statutory language in the regulation. Thus, a person who is authorized to access protected health information is similarly situated, for purposes of this regulation, to another person at the covered entity, business associate of the covered entity, or organized health care arrangement in which the covered entity participates, who is also authorized to access protected health information (even if the two persons may not be authorized to access the same types of protected health information). For example, a physician who has authority to use or disclose protected health information at a hospital by virtue of participating in an organized health care arrangement with the hospital is similarly situated to a nurse or billing employee at the hospital. In contrast, the physician is not similarly situated to an employee at the hospital who is not authorized to access protected health information.

Additionally, we have interpreted “same facility” to mean the same covered entity, business associate, or organized health care arrangement in which the covered entity participates and have substituted this language in the regulation. By focusing on the legal entity or status of the entities as an organized health care arrangement when interpreting “same facility,” we believe we have more clearly captured the intent of the statute and have also alleviated commenter concerns that the term “facility” was too narrow. Therefore, the size of the covered entity,

business associate, or organized health care arrangement will dictate the scope of this exception. If a covered entity has a single location, then the exception will apply to disclosures between a workforce member and, e.g., a physician with staff privileges at that single location. However, if a covered entity has multiple locations across the country, the same exception will apply even if the workforce member makes the disclosure to a physician with staff privileges at a facility located in another state.

We interpret the statutory limitation that the information not be “further acquired, accessed, used, or disclosed without authorization” as meaning that the information is not further used or disclosed in a manner not permitted by the Privacy Rule. Thus, this exception encompasses circumstances in which a person who is authorized to use or disclose protected health information within a covered entity, business associate, or organized health care arrangement inadvertently discloses that information to another person who is authorized to use or disclose protected health information within the same covered entity, business associate, or organized health care arrangement, as long as the recipient does not further use or disclose the information in violation of the Privacy Rule.

The final regulatory exception to breach at paragraph (2)(iii) of this definition mirrors the exception found in section 13400(1)(A) of the Act. The statute excepts from the definition of “breach” situations in which the unauthorized person to whom protected health information has been disclosed would not reasonably have been able to retain the information. We have slightly modified this language to except from “breach” situations where a covered entity or business associate has a good faith belief that the unauthorized person to whom the disclosure of protected health information was made would not reasonably have been able to retain the information.

For example, a covered entity, due to a lack of reasonable safeguards, sends a number of explanations of benefits (EOBs) to the wrong individuals. A few of the EOBs are returned by the post office, unopened, as undeliverable. In these circumstances, the covered entity can conclude that the improper addressees could not reasonably have retained the information. The EOBs that were not returned as undeliverable, however, and that the covered entity knows were sent to the wrong individuals, should be treated as potential breaches.

As another example, a nurse mistakenly hands a patient the discharge papers belonging to another patient, but she quickly realizes her mistake and recovers the protected health information from the patient. If the nurse can reasonably conclude that the patient could not have read or otherwise retained the information, then this would not constitute a breach.

With respect to any of the three exceptions discussed above, a covered entity or business associate has the burden of proof, pursuant to § 164.414(b) (discussed below), for showing why breach notification was not required. Accordingly, the covered entity or business associate must document why the impermissible use or disclosure falls under one of the above exceptions.

Based on the above, we envision that covered entities and business associates will need to do the following to determine whether a breach occurred. First, the covered entity or business associate must determine whether there has been an impermissible use or disclosure of protected health information under the Privacy Rule. Second, the covered entity or business associate must determine, and document, whether the impermissible use or disclosure compromises the security or privacy of the protected health information. This occurs when there is a significant risk of financial, reputational, or other harm to the individual. Lastly, the covered entity or business associate may need to determine whether the incident falls under one of the exceptions in paragraph (2) of the breach definition.

We treat the breach as having occurred at the time of the impermissible use or disclosure (or in the case of the exceptions listed at paragraphs (2)(i) and (ii) of the definition of “breach,” at the time of the “further” impermissible use or disclosure), but recognize that a covered entity or business associate may require a reasonable amount of time to confirm whether the incident qualifies as a breach. As discussed below, a breach is considered discovered when the incident becomes known, not when the covered entity or business associate concludes the above analysis of whether the facts constitute a breach.

2. Unsecured Protected Health Information

The interim final rule adopts a definition of “unsecured protected health information” to identify to what information the breach notification provisions apply. Section 13402(h)(1)(A) of the Act defines “unsecured protected health information” as “protected health information that is not secured through the use of a technology or methodology specified by the Secretary in guidance issued under [section 13402(h)(2)].” Further, the Act at section 13402(h)(2) requires that the Secretary specify in the guidance the technologies and methodologies that render protected health information unusable, unreadable, or indecipherable to unauthorized individuals. Accordingly, the interim final rule defines “unsecured protected health information” to mean protected health information that is not rendered unusable, unreadable, or indecipherable to unauthorized individuals through the use of a technology or methodology specified by the Secretary in guidance. We also provide in the regulation that the guidance will be published on the HHS Web site.

Section 13402(h)(2) of the Act required that the Secretary initially issue such guidance, after consultation with stakeholders, no later than 60 days after enactment, or April 17, 2009. As discussed above, the Secretary issued the guidance along with a request for information on April 17, 2009, on the HHS Web site at
http://www.hhs.gov/ocr/privacy/
and the guidance was later published in the
Federal Register
on April 27, 2009 (74 FR 19006). The Department has reviewed the public comment received in response to the request for information and provides an update to the guidance in Section II of this document. As provided in this interim final rule, this updated guidance is also (and any future updates will be) available on the HHS Web site at
http://www.hhs.gov/ocr/privacy/
.

We note that the definition of “unsecured protected health information” in the Act and this interim final rule incorporates generally the term “protected health information,” as defined at 45 CFR 160.103 of the HIPAA Rules, which includes information in any form or medium. Accordingly, the term “unsecured protected health information” can include information in any form or medium, including electronic, paper, or oral form.

C. Notification to Individuals—Section 164.404

Section 164.404 of the interim final rule provides the requirements for the notifications covered entities are to provide to individuals affected by a breach of unsecured protected health information. This section includes implementation specifications regarding timeliness, content, and methods of the notice.

General Rule

Section 164.404(a)(1) provides the general rule that a covered entity shall, following the discovery of a breach of unsecured protected health information, notify each individual whose unsecured protected health information has been, or is reasonably believed by the covered entity to have been, accessed, acquired, used, or disclosed as a result of such breach. This regulatory provision implements section 13402(a) of the Act, but does not include the phrase “that accesses, maintains, retains, modifies, records, stores, destroys, or otherwise holds, uses, or discloses” used in the statute to describe a covered entity's actions with respect to unsecured protected health information because inclusion of such terms was deemed unnecessary. In addition, the statute refers to protected health information that has been “accessed, acquired, or disclosed”; it does not include “used.” In contrast, the statutory definition of “breach” refers to the “acquisition, access, use, or disclosure” of protected health information. For consistency with the definition, therefore, we have added “used” to the list of actions for which notification is required in § 164.404(a)(1).

Breaches Treated as Discovered

Section 164.404(a)(2) states that a breach shall be treated as discovered by a covered entity as of the first day the breach is known to the covered entity, or by exercising reasonable diligence would have been known to the covered entity. Thus, a covered entity is not liable for failing to provide notification in cases in which it is not aware of a breach unless the covered entity would have been aware of the breach had it exercised reasonable diligence. Section 164.404(a)(2) further provides that a covered entity is deemed to have knowledge of a breach if such breach is known, or by exercising reasonable diligence would have been known, to any person, other than the person committing the breach, who is a workforce member or agent of the covered entity (determined in accordance with the federal common law of agency). These provisions implement section 13402(c) of the Act but clarify that the federal common law of agency is to control in determining who is an agent of the covered entity. This approach is consistent with the HIPAA Enforcement Rule (45 CFR part 160, subparts C through E), which provides that the federal common law of agency applies in determining agency liability under the HIPAA Rules.

We have also modified the statutory language slightly to better conform to existing language in the HIPAA Enforcement Rule by incorporating the term “by exercising reasonable diligence.” The term “reasonable diligence” means the “business care and prudence expected from a person seeking to satisfy a legal requirement under similar circumstances.” We have made these clarifications for consistency and uniformity across the regulations.

Because a covered entity or business associate is liable for failing to provide notice of a breach when the covered entity or business associate did not know—but by exercising reasonable diligence would have known—of a breach, it is important for such entities to implement reasonable systems for discovery of breaches. We also note that these provisions attribute knowledge of a breach by a workforce member or other agent (other than the person committing the breach), such as certain business associates, to the covered entity itself. This is important, as knowledge of a breach,
i.e.,
when a breach is treated as “discovered,” starts the clock in terms of the period of time a covered entity has to make the notifications required by the interim final rule. Thus, covered entities should ensure their workforce members and other agents are adequately trained and aware of the importance of timely reporting of privacy and security incidents and of the consequences of failing to do so.

Timeliness

Regarding timeliness of individual notifications, § 164.404(b) mirrors the statutory requirement in section 13402(d) of the Act and requires that, except when law enforcement requests a delay in accordance with § 164.412 (provision discussed below), a covered entity shall send the required notification without unreasonable delay and in no case later than 60 calendar days after the date the breach was discovered by the covered entity. Thus, provisions for timeliness should be read together with the above provisions for when a breach is treated as discovered. We expect a covered entity to make the individual notifications as soon as reasonably possible. The covered entity may take a reasonable time to investigate the circumstances surrounding the breach, in order to collect and develop the information that § 164.404(c) requires to be included in the notice to the individual. As discussed below, covered entities are also permitted to provide the required information to individuals within the required time period in multiple mailings as the information becomes available.

In response to the RFI, some commenters suggested that suspected but unconfirmed breaches should not be treated as discovered until all the facts of the breach could be confirmed. Others suggested that 60 days was an insufficient amount of time to conduct a complete investigation and send the required notifications. We disagree. Waiting longer than 60 days to notify individuals of breaches of their unsecured protected health information could substantially increase the risk of harm to individuals as a result of the breach and decrease the ability of the individuals to effectively protect themselves from such harm. The statute and interim final rule provide that the notification must be provided without unreasonable delay and in no case later than 60 calendar days. The purpose of this period is to give covered entities and business associates time to conduct a prompt investigation into the incident to identify and collect the information needed to provide meaningful notice to the individual about what happened. Thus, the time period for breach notification begins when the incident is first known, not when the investigation of the incident is complete, even if it is initially unclear whether the incident constitutes a breach as defined in this rule.

Further, the duration of an investigation is limited by the statute and interim final rule's requirement that any delay be reasonable—the investigation cannot take an unreasonable amount of time. Thus, if a covered entity learns of an impermissible use or disclosure but unreasonably allows the investigation to lag for 30 days, this would constitute an unreasonable delay. Further, the 60 days is an outer limit and therefore, in some cases, it may be an “unreasonable delay” to wait until the 60th day to provide notification. For example, if a covered entity has compiled the information necessary to provide notification to individuals on day 10 but waits until day 60 to send the notifications, it would constitute an unreasonable delay despite the fact that the covered entity has provided notification within 60 days.

We also note that if a covered entity promptly investigates a reported breach and can swiftly conclude that there was no breach, then the covered entity need not send out breach notifications. For example, where a laptop with unsecured protected health information is initially reported by an employee to be stolen but is discovered the next day in another secure office within the

covered entity, then the covered entity need not send out breach notifications.

Content

Section 13402(f) of the Act sets forth the content requirements for the breach notice to the individual. Section 164.404(c) of the interim final rule implements section 13402(f) of the Act and requires the notification to include, to the extent possible, the following elements: (1) A brief description of what happened, including the date of the breach and the date of the discovery of the breach, if known; (2) A description of the types of unsecured protected health information that were involved in the breach (such as whether full name, social security number, date of birth, home address, account number, diagnosis, disability code, or other types of information were involved); (3) any steps individuals should take to protect themselves from potential harm resulting from the breach; (4) a brief description of what the covered entity involved is doing to investigate the breach, to mitigate harm to individuals, and to protect against any further breaches; and (5) contact procedures for individuals to ask questions or learn additional information, which must include a toll-free telephone number, an e-mail address, Web site, or postal address. With respect to indicating in the notification the types of protected health information involved in a breach, we emphasize that this provision requires covered entities to describe only the types of information involved. Thus, covered entities should not include a listing of the actual protected health information that was breached (e.g., list in the notice the individual's social security number or credit card number that was breached) and generally should avoid including any sensitive information in the notification itself. Further, in the interim final rule at § 164.404(c)(1)(B), we add the term “diagnosis” in the parenthetical listing of examples of types of protected health information to make clear that, where appropriate, a covered entity may need to indicate in the notification to the individual whether and what types of treatment information were involved in a breach. In addition, at § 164.404(c)(1)(D), we replace the statutory term “mitigate losses” with “mitigate harm to the individual” to make clear that the notification should describe the steps the covered entity is taking to mitigate potential harm to the individual resulting from the breach and that such harm is not limited to economic loss.

Under these content requirements, for example, and depending on the circumstances, the notice to the individual may include recommendations that the individual contact his or her credit card company and information about how to contact the credit bureaus and obtain credit monitoring services (if credit card information was breached); information about steps the covered entity is taking to retrieve the breached information, such as filing a police report (if a suspected theft of unsecured protected health information occurred); information about steps the covered entity is taking to improve security to prevent future similar breaches; and information about sanctions the covered entity imposed on workforce members involved in the breach.

Some commenters recommended that we impose a page limitation on the length of the notice (e.g., one page in length) and ensure the content of the notice is non-technical and non-complex so individuals can easily understand the information being provided. We agree that it is important for individuals to be able to understand the information being provided to them in the breach notifications and thus, at § 164.404(c)(2) of the interim final rule, include a requirement that such notifications be written in plain language. To satisfy this requirement, the covered entity should write the notice at an appropriate reading level, using clear language and syntax, and not include any extraneous material that might diminish the message it is trying to convey. We do not impose a page limitation, however, so as not to constrain covered entities in including in the notifications the information they believe could be helpful to individuals.

Further, we note that some covered entities may have obligations under other laws with respect to their communication with affected individuals. For example, to the extent a covered entity is obligated to comply with Title VI of the Civil Rights Act of 1964, the covered entity must take reasonable steps to ensure meaningful access for Limited English Proficient persons to the services of the covered entity, which could include translating the notice into frequently encountered languages. Similarly, to the extent that a covered entity is obligated to comply with Section 504 of the Rehabilitation Act of 1973 or the Americans with Disabilities Act of 1990, the covered entity has an obligation to take steps that may be necessary to ensure effective communication with individuals with disabilities, which could include making the notice available in alternate formats, such as Braille, large print, or audio.

Methods of Notification

Section 13402(e)(1) of the Act provides for both actual written notice to the individual, as well as substitute notice to the individual if contact information is insufficient or out-of-date. Accordingly, the interim final rule at § 164.404(d) adopts the statutory provisions for actual and substitute breach notification to the individual.

Section 164.404(d)(1)(i) requires a covered entity to provide breach notice to the individual in written form by first-class mail at the last known address of the individual. Consistent with the statute, the interim final rule also provides that written notice may be in the form of electronic mail, provided the individual agrees to receive electronic notice and such agreement has not been withdrawn. We note that, consistent with § 164.502(g) of the Privacy Rule, where the individual affected by a breach is a minor or otherwise lacks legal capacity due to a physical or mental condition, notice to the parent or other person who is the personal representative of the individual will satisfy the requirements of § 164.404(d)(1). The statute also requires that, if the individual is deceased, notice must be sent to the last known address of the next of kin. The interim final rule adopts this provision at § 164.404(d)(1)(ii), but provides that such notice be sent to either the individual's next of kin or personal representative, as such term is used for purposes of the Privacy Rule, recognizing that in some cases, a covered entity may have contact information for a personal representative of a deceased individual rather than the next of kin. We believe this conforms to the intent of the statute and improves consistency between this subpart and the Privacy Rule. Under 45 CFR 164.502(g), a “personal representative” of a deceased individual is a person who has authority to act on behalf of the decedent or the decedent's estate. The interim final rule also clarifies that a covered entity is only required to provide notice to next of kin or the personal representative if the covered entity both knows the individual is deceased and has the address of the next of kin or personal representative of the decedent. This clarification should address some of the comments which raised both administrative and privacy concerns with a covered entity being required to obtain contact information for next of kin of a deceased patient, if the individual did not otherwise provide the information while alive.

If a covered entity does not have sufficient contact information for some or all of the affected individuals, or if some notices are returned as undeliverable, the covered entity must provide substitute notice for the unreachable individuals in accordance with § 164.404(d)(2) of the interim final rule. Substitute notice should be provided as soon as reasonably possible after the covered entity is aware that it has insufficient or out-of-date contact information for one or more affected individuals. Whatever form of substitute notice is provided, the notice must contain all the elements that § 164.404(c) requires be included in the direct written notice to individuals. With respect to decedents, however, the rule provides that a covered entity is not required to provide substitute notice for the next of kin or personal representative in cases where the covered entity either does not have contact information or has out-of-date contact information for the next of kin or personal representative.

Section 164.404(d)(2) requires that the substitute form of notice be reasonably calculated to reach the individuals for whom it is being provided. If there are fewer than 10 individuals for whom the covered entity has insufficient or out-of-date contact information to provide the written notice, § 164.404(d)(2)(i) permits the covered entity to provide substitute notice to such individuals through an alternative form of written notice, by telephone, or other means. For example, if the covered entity learns that the home address it has for one of its patients is out-of-date but it has the patient's e-mail address, it may provide substitute notice by e-mail even if the patient has not agreed to electronic notice. Similarly, in the above example, if the covered entity has a current telephone number rather than e-mail address for the patient, then the covered entity may telephone the patient and provide the information required by the notice over the phone. We note, however, that the covered entity should be sensitive to not unnecessarily disclose protected health information in the process of providing substitute notice, such as where the covered entity leaves an answering machine message that could be picked up by other household members. In such cases, the covered entity should take care to limit the amount of information disclosed on an answering machine message, such as, for example, by leaving only its name and number and indicating it has a very important message for the individual. Alternatively, posting a notice on the Web site of the covered entity or at another location may be appropriate if the covered entity lacks any current contact information for the patients, so long as the posting is done in a manner that is reasonably calculated to reach the individuals.

If a covered entity has insufficient or out-of-date contact information for 10 or more individuals, then § 164.404(d)(2)(ii) requires the covered entity to provide substitute notice through either a conspicuous posting for a period of 90 days on the home page of its Web site or conspicuous notice in major print or broadcast media in geographic areas where the individuals affected by the breach likely reside. As described above, these substitute notifications must be provided in a manner that is reasonably calculated to reach the affected individuals. In addition, substitute notice through the Web site or media for 10 or more individuals requires the covered entity to have a toll-free phone number, active for 90 days, where an individual can learn whether the individual's unsecured protected health information may be included in the breach and to include the number in the notice.

If the covered entity chooses to provide substitute notice on the home page of its Web site, the notice must be conspicuous and posted for at least 90 days. A covered entity may provide all the information described at § 164.404(c) directly on its home page or may provide a hyperlink to the notice containing such information. We interpret “home page” to include the home page for visitors to the covered entity's Web site and the landing page or login page for existing account holders. If a covered entity uses a hyperlink on the home page to convey the substitute notice, the hyperlink should be prominent so that it is noticeable given its size, color, and graphic treatment in relation to other parts of the page, and it should be worded to convey the nature and importance of the information to which it leads.

Alternatively, or if the covered entity does not have or does not wish to use a Web site for the substitute notice, the covered entity may provide substitute notice of the breach in major print or broadcast media in geographic areas where the individuals affected by the breach likely reside. What constitutes major print or broadcast media for a particular area will depend on the geographic area where the affected individuals are likely to reside and what is reasonably calculated to reach the affected individuals. We emphasize that what is considered major print or broadcast media for a metropolitan area may be very different from what is considered major print or broadcast media in a rural area. For example, if the affected individuals are reasonably likely to reside in a rural area, then a local newspaper could be the major newspaper serving that area and most likely to reach the individuals affected. For affected individuals in a metropolitan area, then a newspaper serving the entire metropolitan area or the entire State would be more likely to reach the individuals affected. If the affected individuals likely reside in different regions or States, then the covered entity may need to utilize multiple media outlets to reasonably reach these individuals.

Also, we clarify in this interim final rule that any notice in print or broadcast media under this section must be conspicuous, similar to the posting on the Web site. Thus, for example, for notice in print media, thought should be given to what location and duration of the notice is reasonably calculated to reach the affected individuals.

Some commenters were concerned that providing substitute notice in major media would be costly and onerous. Covered entities that are concerned with the cost of providing substitute notice in this manner have the option of instead posting the substitute notice on their Web sites. For smaller covered entities that do not have Web sites, we would expect those covered entities generally serve a patient population located in a relatively compact and discrete area. In such cases, the geographic area in which the affected individuals reside would be comparably small, and, therefore, we do not believe that providing substitute notice in the appropriate local newspaper or television station would be excessively costly or onerous. Finally, we note that covered entities with out-of-date or insufficient contact information for some individuals can attempt to update the contact information so that they can provide direct written notification, in order to limit the number of individuals for whom substitute notice is required and, thus, potentially avoid the obligation to provide substitute notice through a Web site or major print or broadcast media under § 164.404(d)(2)(ii).

Other commenters were concerned that the requirement to include a toll-free phone number in the substitute media notice would overly burden a covered entity with calls from individuals unaffected by the breach. We note that the statute requires that covered entities include a toll-free phone number in cases where substitute notice is required for 10 or more individuals. Covered entities concerned

with the number of calls they may receive from unaffected individuals may wish to include sufficient information in the notice itself or a Web address in the notice for more information (or other means) as a way for individuals to determine whether their information may have been included in the breach.

Additional Notice in Urgent Situations

Finally, § 164.404(d)(3) of the interim final rule implements the provision in the statute at section 13402(e)(1)(c), which makes clear that notice by telephone or other means may be made, in addition to written notice, in cases deemed by the covered entity to require urgency because of possible imminent misuse of unsecured protected health information. We emphasize, however, that such notice, if utilized, is in addition to, and not in lieu of, the direct written notice required by § 164.404(d)(1).

D. Notification to the Media—164.406

Section 164.406 implements section 13402(e)(2) of the Act, which requires that notice be provided to prominent media outlets serving a State or jurisdiction, following the discovery of a breach if the unsecured protected health information of more than 500 residents of such State or jurisdiction is, or is reasonably believed to have been, accessed, acquired, or disclosed during such breach. This media notice differs from the substitute media notice described in § 164.404(d)(1)(2) in that it is directed “to” the media and is intended to supplement, but not substitute for, individual notice. The Act requires that notification to the media under this provision be provided within the same timeframe as notice is to be provided to the individual. See section 13402(d)(1) of the Act. Accordingly, § 164.406(b) of the interim final rule requires a covered entity to notify prominent media outlets without unreasonable delay and in no case later than 60 calendar days after discovery of the breach. In paragraph (c) of this section, we require that notification to the media under this provision include the same information required to be included in the notification to the individual under § 164.404(c). We expect that most covered entities will provide notification to the media under this section in the form of a press release.

Commenters asked that we define what constitutes a “prominent media outlet.” We do not define “prominent media outlet” in this regulation because what constitutes a prominent media outlet will differ depending upon the State or jurisdiction affected. For example, for a breach affecting 500 or more individuals across a particular state, a prominent media outlet may be a major, general-interest newspaper with a daily circulation throughout the entire state. In contrast, a newspaper serving only one town and distributed on a monthly basis, or a daily newspaper of specialized interest (such as sport, politics) would not be viewed as a prominent media outlet. If a breach affects 500 or more individuals in a limited jurisdiction, such as a city, then a prominent media outlet may be a major, general-interest newspaper with daily circulation throughout the city, even though the newspaper does not serve the whole State.

Commenters also asked HHS to clarify what is meant by “State or jurisdiction” for purposes of notice to the media under this provision. We note that “State” is already defined at § 160.103 of the HIPAA Rules to mean “any of the several States, the District of Columbia, the Commonwealth of Puerto Rico, the Virgin Islands, and Guam.” That definition applies to this new provision. We also note that the Act includes a definition of “State” which applies for purposes of this provision and defines “State” to include, in addition to what is included at § 160.103, American Samoa and the Northern Mariana Islands. Thus, we provide at § 164.406(a) that, for purposes of this provision, “State” also includes American Samoa and the Northern Mariana Islands. With respect to jurisdiction, we clarify that, for purposes of this provision, jurisdiction is a geographic area smaller than a state, such as a county, city, or town.

To illustrate how these provisions apply, we provide the following example. If laptops containing the unsecured protected health information of more than 500 residents of a particular city were stolen from a covered entity, notification under this section should be provided to prominent media outlets serving that city. In this case, the prominent media outlet may be a major television station or newspaper (or other media outlet) serving primarily the residents of that city or a prominent media outlet serving the entire state. Alternatively, for a breach involving 500 or more residents across a State and not within any one particular county or city of the State, the prominent media outlet chosen must serve the entire State.

In response to comments received, we also offer clarification on how to address a breach involving residents in multiple States or jurisdictions. For example, if a covered entity discovers a breach of 600 individuals, 200 of which reside in Virginia, 200 of which reside in Maryland, and 200 of which reside in the District of Columbia, such a breach did not affect more than 500 residents of any one State or jurisdiction, and as such, notification is not required to be provided to the media pursuant to § 164.406. However, individual notification under § 164.404 would be required, as would notification to the Secretary under § 164.408 because the breach involved 500 or more individuals. Conversely, if a covered entity discovered a breach of unsecured protected health information involving 600 residents within the state of Maryland and 600 residents of the District of Columbia, notification must be provided to a prominent media outlet serving the state of Maryland and to a prominent media outlet serving the District of Columbia.

We also recognize that in some cases a breach may occur at a business associate and involve the protected health information of multiple covered entities. In that case, a covered entity involved would only be required to provide notification to the media if the information breached included the protected health information of 500 or more individuals located in any one State or jurisdiction. For example, if a business associate discovers a breach affecting 800 individuals, the business associate must notify the appropriate covered entity (or covered entities) subject to § 164.410 (discussed below). If 450 of the affected individuals are patients of one covered entity and the remaining 350 are patients of another covered entity, because the breach has not affected more than 500 individuals at either covered entity, there is no obligation to provide notification to the media under this section. Additionally, neither covered entity has the obligation of notifying the Secretary under § 164.408(b) concurrently with notice to the affected individuals; however, both covered entities must include this breach in their annual submission to the Secretary pursuant to § 164.408(c). In cases where the entities involved are unable to determine which entity's protected health information was involved, the covered entities may consider having the business associate provide the notification to the media on behalf of all of the covered entities.

Section 164.406(c) sets forth the content requirement for covered entities notifying the media. In this section, we require that the notice to the media include the same content as that required for notification to the individual under § 164.404(c). We emphasize that this provision does not replace either direct written or

substitute notice to the individual under § 164.404. If a covered entity is required to provide substitute notice under § 164.404(d)(2)(ii)(A) and chooses to do so through major print or broadcast media, notification to the media under this section would only satisfy such substitute notice if the prominent media outlet ran a notification reasonably calculated to reach the individuals for which substitute notice was required and included all the information required be provided in the individual notice, including the toll-free number required by § 164.404(d)(2)(ii)(B).

E. Notification to the Secretary—164.408

Section 164.408 of the interim final rule implements section 13402(e)(3) of the Act, which requires covered entities to notify the Secretary of breaches of unsecured protected health information. For breaches involving 500 or more individuals, the Act requires covered entities to notify the Secretary immediately. For breaches involving less than 500 individuals, the Act provides that a covered entity may maintain a log of such breaches and annually submit such log to the Secretary documenting the breaches occurring during the year involved.

Section 164.408(a) of the interim final rule contains the general rule that requires a covered entity to notify the Secretary following the discovery of a breach of unsecured protected health information. Section 164.408(b) provides the implementation specification for breaches involving 500 or more individuals. Section 164.408(c) provides the implementation specification for breaches involving fewer than 500 individuals.

With respect to breaches involving 500 or more individuals, we interpret the term “immediately” in the statute to require notification be sent to the Secretary in the case of these larger breaches concurrently with the notification sent to the individual under § 164.404, which must be sent without unreasonable delay but in no case later than 60 calendar days following discovery of a breach. Many commenters were concerned that covered entities would be required to provide notification to the Secretary in a much shorter time frame than the other notifications required by the Act, making it difficult for covered entities to comply. This interpretation thus allows the notice to the Secretary to include all of the information provided in the notice to the individual and better avoids the situation where a covered entity reports information to the Secretary that later turns out to be incorrect because the entity did not have sufficient time to conduct an investigation into the facts surrounding the breach. In addition, this interpretation satisfies the statutory requirement that notifications of larger breaches be provided to the Secretary immediately as compared to the reports of smaller breaches the statute allows be reported annually to the Secretary. The interim final rule also provides that the notification be provided in a manner to be specified on the HHS Web site. The Department will post instructions on its Web site for submitting both this notification as well as the annual notification described below. In addition, as required by section 13402(e)(4) of the Act, the Secretary will post on the HHS Web site a list of covered entities that submit reports of breaches of unsecured protected health information involving more than 500 individuals.

Covered entities must notify the Secretary of discovered breaches involving more than 500 individuals generally, without regard to whether the breach involved more than 500 residents of a particular State or jurisdiction (the threshold for triggering notification to the media under § 164.406 of the interim final rule). Thus, where a covered entity has discovered a breach of 600 individuals, 300 of which reside in Maryland and 300 of which reside in the District of Columbia, notification of the breach must be provided to the Secretary concurrently with notification to the affected individuals. However, the breach in this example would not trigger the requirement to notify the media under § 164.406 because the breach did not involve more than 500 residents of any one State or jurisdiction.

For breaches involving less than 500 individuals, § 164.408(c) requires a covered entity to maintain a log or other documentation of such breaches and to submit information annually to the Secretary for breaches occurring during the preceding calendar year. As recommended by several commenters, we have designated a date for submission of the information to the Secretary. The interim final rule requires the submission of this information to the Secretary no later than 60 days after the end of each calendar year. As with notification of the larger breaches above, the interim final rule provides that information about breaches involving less than 500 individuals is to be provided to the Secretary in the manner specified on the HHS Web site. HHS will specify on its Web site the information to be submitted and how to submit such information.

For calendar year 2009, the covered entity is only required to submit information to the Secretary for breaches occurring after the effective date of this regulation, i.e., on or after September 23, 2009. Information about breaches occurring prior to that date need not be submitted. This is because, pursuant to § 164.400, this subpart only applies to breaches occurring on or after that date.

We emphasize that although covered entities need only provide notification to the Secretary of breaches involving less than 500 individuals annually, they must still provide notification of such breaches to affected individuals without unreasonable delay and not later than 60 days after discovery of the breach pursuant to § 164.404. In addition, we note that pursuant to § 164.414(a), a covered entity must follow the documentation requirements that otherwise apply to the HIPAA Privacy Rule under § 164.530 with respect to the requirements of this rule. Thus, pursuant to § 164.530(j)(2), covered entities must maintain the internal log or other documentation for six years. Further, as with other required documentation, a covered entity must make such information available to the Secretary upon request in accordance with § 160.310.

F. Notification by a Business Associate—164.410

Section 13402(b) of the Act requires a business associate of a covered entity that accesses, maintains, retains, modifies, records, destroys, or otherwise holds, uses, or discloses unsecured protected health information to notify the covered entity when it discovers a breach of such information. Section 164.410(a) implements section 13402(b) of the Act, but does not include the terms “that accesses, maintains, retains, modifies, records, stores, destroys, or otherwise holds, uses, or discloses” used in the statute to describe a business associate's actions with respect to unsecured protected health information because inclusion of such terms was deemed unnecessary.

Thus, following the discovery of a breach of unsecured protected health information, a business associate is required to notify the covered entity of the breach so that the covered entity can notify affected individuals. We clarify that a business associate that maintains the protected health information of multiple covered entities need notify only the covered entity(s) to which the breached information relates. However, in cases in which a breach involves the

unsecured protected health information of multiple covered entities and it is unclear to whom the breached information relates, it may be necessary to notify all potential affected covered entities.

We received several comments in support of adding a provision to require business associates to provide notice to a senior official or privacy official at the covered entity. We do not believe such a provision is necessary, however. Covered entities and business associates already have established business relationships and communication channels, including with respect to privacy and security matters. For example, the HIPAA Rules already require a business associate contract to provide that the business associate report to the covered entity uses or disclosures not provided by the contract as well as security incidents of which the business associate becomes aware. See 45 CFR 164.504(e)(2)(ii)(C) and 164.314(a)(2)(i)(C). Thus, we believe it is appropriate to leave it up to covered entities and business associates to determine how the required reporting should be implemented.

Section 164.410(a)(2) implements section 13402(c) of the Act, which provides when a breach is to be treated as discovered by the business associate. Accordingly, § 164.410(a)(2) states that a breach shall be treated as discovered by a business associate as of the first day on which such breach is known to the business associate or, by exercising reasonable diligence, would have been known to the business associate. Section 164.410(a)(2) further provides that a business associate shall be deemed to have knowledge of a breach if the breach is known, or by exercising reasonable diligence would have been known, to any person, other than the person committing the breach, who is an employee, officer, or other agent of the business associate (determined in accordance with the federal common law of agency). As with § 164.404(a)(2) with respect to a covered entity's knowledge of a breach, we clarify in this provision that the federal common law of agency is to control in determining who is an agent of the covered entity. This approach is consistent with the HIPAA Enforcement Rule (45 CFR part 160, subparts C through E), which provides that the federal common law of agency applies in determining agency liability under the HIPAA Rules. Also, as with § 164.404(a)(2), we have modified the statutory language slightly to better conform to existing language in the HIPAA Enforcement Rule at 45 CFR 160.410, by incorporating the term “reasonable diligence.” We have made these clarifications for consistency and uniformity across the regulations.

Section 164.410(b) implements section 13402(d)(1) of the Act and provides that, with the exception provided in § 164.412, a business associate must provide notice of a breach of unsecured protected health information to a covered entity without unreasonable delay and in no case later than 60 days following the discovery of a breach. With respect to breaches at the business associate, the covered entity must provide the required notifications to affected individuals under § 164.404(a) without unreasonable delay, but no later than 60 days.

If a business associate is acting as an agent of a covered entity, then, pursuant to § 164.404(a)(2), the business associate's discovery of the breach will be imputed to the covered entity. Accordingly, in such circumstances, the covered entity must provide notifications under § 164.404(a) based on the time the business associate discovers the breach, not from the time the business associate notifies the covered entity. In contrast, if the business associate is an independent contractor of the covered entity (i.e., not an agent), then the covered entity must provide notification based on the time the business associate notifies the covered entity of the breach. As reflected in the comments we received in response to the timing of business associate notification to a covered entity following a breach, covered entities may wish to address the timing of the notification in their business associate contracts.

Section 164.410(c) implements the second sentence of section 13402(b) of the Act, which specifies the information that a business associate must provide to a covered entity following a breach of unsecured protected health information. Section 164.410(c)(1) requires business associates, to the extent possible, to provide covered entities with the identity of each individual whose unsecured protected health information has been, or is reasonably believed to have been, breached. Depending on the circumstances, business associates may provide the covered entity with immediate notification of the breach, as discussed above and then follow up with the required information in § 164.410(c) when available but without unreasonable delay and within 60 days.

Section 164.410(c)(1) departs slightly from the statutory language by only requiring business associates to provide this information “to the extent possible.” Based on some comments received, we recognize that there may be situations in which a business associate may be unaware of the identification of the individuals whose unsecured protected health information was breached. For example, a business associate that is a record storage company holds hundreds of boxes of paper medical records on behalf of a covered entity. The business associate discovers that several boxes are missing and is unable to provide the covered entity with a list of the individuals whose information has been breached. It is not our intent that the business associate delay notification of the breach to the covered entity, when the covered entity may be better able to identify the individuals affected.

Further, we recognize that, depending on the circumstances surrounding a breach of unsecured protected health information, a business associate may be in the best position to gather the information the covered entity is required by § 164.404(c) to include in the notification to the individual about the breach. Thus, in addition to the identification of affected individuals, § 164.410(c)(2) requires a business associate to provide the covered entity with any other available information that the covered entity is required to include in the notification to the individual under § 164.404(c), either at the time it provides notice to the covered entity of the breach or promptly thereafter as information becomes available. Because we allow this information to be provided to a covered entity after the initial notification of the breach as it becomes available, a business associate should not delay the initial notification to the covered entity of the breach in order to collect information needed for the notification to the individual. To ensure the covered entity is aware of all the available facts surrounding a breach, we also note that a business associate should provide this information even if it becomes available after notifications have been sent to affected individuals or after the 60-day period specified in § 164.410(b) has elapsed.

In response to a significant number of commenters who expressed concern that this requirement would prevent covered entities and their business associates from addressing these issues in their business associate contracts, we emphasize that we do not intend for this section to interfere with the current relationship between covered entities and their business associates. Business associates and covered entities will continue to have the flexibility to set forth specific obligations for each party, such as who will provide notice to individuals and when the notification from the business associate to the

covered entity will be required, following a breach of unsecured protected health information, so long as all required notifications are provided and the other requirements of the interim final rule are met. We encourage the parties to consider which entity is in the best position to provide notice to the individual, which may depend on circumstances, such as the functions the business associate performs on behalf of the covered entity and which entity has the relationship with the individual. We also encourage the parties to ensure the individual does not receive notifications from both the covered entity and the business associate about the same breach, which may be confusing to the individual.

Finally, we note that where an entity provides PHRs to customers of a HIPAA covered entity through a business associate arrangement but also provides PHRs directly to the public and a breach of its records occurs, in certain cases, as described in its rule, the FTC will deem compliance with certain provisions of HHS' rule as compliance with FTC's rule. In particular, in such situations, it may be appropriate for the vendor to provide the same breach notice to all its PHR customers since it has a direct relationship with all the affected individuals. Thus, in those limited circumstances where a vendor of PHRs (1) provides notice to individuals on behalf of a HIPAA covered entity, (2) has dealt directly with these individuals in managing their personal health record accounts, and (3) provides notice to its customers at the same time, the FTC will deem compliance with HHS requirements governing the timing, method, and content of notice to be compliance with the corresponding FTC rule provisions.
11

11
We note, however, that with respect to the customers to whom it provides PHRs directly, the vendor must comply with all other FTC rule requirements, including the requirement to notify the FTC within ten business days after discovering the breach.

G. Law Enforcement Delay—164.412

Section 13402(g) of the Act provides that if a law enforcement official determines that a notification, notice, or posting required under this section would impede a criminal investigation or cause damage to national security, such notification, notice, or posting shall be delayed in the same manner as provided under 45 CFR 164.528(a)(2) of the Privacy Rule in the case of a disclosure covered under such section. Section 164.412 implements section 13402(g) of the Act and thus, requires a covered entity or business associate to temporarily delay notification under §§ 164.404, 164.406, 164.408, and 164.410 if instructed to do so by a law enforcement official.

We retain the definition of “law enforcement official” currently used in the Privacy Rule at § 164.501, which defines such person as “an officer or employee of any state agency or authority of the United States, a State, a territory, a political subdivision of a State or territory, or an Indian tribe, who is empowered by law to: (1) Investigate or conduct an official inquiry into a potential violation of law; or (2) prosecute or otherwise conduct a criminal, civil, or administrative proceeding arising from an alleged violation of law.” However, in this interim final rule, we move the definition up to § 164.103 so that it will apply to this subpart D as well as continue to apply to subpart E (Privacy Rule).

Section 164.412(a), which is based on the requirements of 45 CFR 164.528(a)(2)(i) of the Privacy Rule, provides for a temporary delay of notification in situations in which a law enforcement official provides a statement in writing that the delay is necessary because notification would impede a criminal investigation or cause damage to national security, and specifies the time for which a delay is required. In these instances, the covered entity is required to delay the notification, notice, or posting for the time period specified by the official.

Similarly, § 164.412(b), which is based on 45 CFR 164.528(a)(2)(ii) of the Privacy Rule, requires a covered entity or business associate to temporarily delay a notification, notice, or posting if a law enforcement official states orally that a notification would impede a criminal investigation or cause damage to national security. However, in this case, the covered entity or business associate is required to document the statement and the identity of the official and delay notification for no longer than 30 days, unless a written statement meeting the above requirements is provided during that time. We interpret these provisions as tolling the time within which notification is required under §§ 164.404, 164.406, 164.408, and 164.410, as applicable.

H. Administrative Requirements and Burden of Proof—164.414

Section 164.414(a) requires covered entities to comply with the administrative requirements of § 164.530(b), (d), (e), (g), (h), (i), and (j) of the Privacy Rule with respect to the breach notification provisions of this subpart. These provisions, for example, require covered entities and business associates to develop and document policies and procedures, train workforce members on and have sanctions for failure to comply with these policies and procedures, permit individuals to file complaints regarding these policies and procedures or a failure to comply with them, and require covered entities to refrain from intimidating or retaliatory acts. Thus, a covered entity is required to consider and incorporate the requirements of this subpart with respect to its administrative compliance and other obligations. In addition to § 164.414(a), to make clear that these provisions apply to this subpart as well as subpart E, we have made conforming modifications in each of the above sections of the Privacy Rule to include a reference to this subpart D.

Consistent with section 13402(d)(2) of the Act, § 164.414(b) provides that, following an impermissible use or disclosure under the Privacy Rule, covered entities and business associates have the burden of demonstrating that all notifications were made as required by this subpart. Additionally, as part of demonstrating that all required notifications were made, we clarify in the regulatory text that a covered entity or business associate, as applicable, also must be able to demonstrate that an impermissible use or disclosure did not constitute a breach, as such term is defined at § 164.402, in cases where the covered entity or business associate determined that notifications were not required. We also make conforming changes to § 160.534 of the HIPAA Enforcement Rule to make clear that, during any administrative hearing, the covered entity has the burden of going forward and the burden of persuasion with respect to these issues.

Thus, when a covered entity or business associate knows of an impermissible use or disclosure of protected health information, it should maintain documentation that all required notifications were made, or, alternatively, of its risk assessment (discussed above in § 164.402) or the application of any exceptions to the definition of “breach” to demonstrate that notification was not required.

I. Other Conforming Changes to the HIPAA Rules

In addition to the conforming modifications discu

[Text truncated at 120,000 characters. The full text is on the page linked above.]

---

Source: Frix Law Library, https://www.frixlaw.com/law-library/documents/fr%3AE9-20169. Public record. Not legal advice.