Privacy Incident Summary and Recommendations

QUESTION

Review the below hypothetical scenario below then draft an internal memo to the CEO and Board of KCH that summaries this particular issue. As part of your memo, include the following information: Brief background paragraph summarizing what occurred. Apply the HIPAA four factor Breach Notification Rule risk assessment to the facts in this incident. Make a determination assigning the following level of risk (high, medium, or low) for each of the four factors in the assessment and identify which facts were important to the risk level you assigned. Then, make an overall conclusion of whether you think this incident would be considered a HITECH breach under HIPAA, or not, based on your assigned risk levels for each of the four factors. As a result of your determination, conclude whether any patients need to be notified? Does the Office for Civil Rights (“OCR”) need to be notified? Does the local media need to be notified? For each of these three audiences, include why you think a notification does or does not need to be made, and include the required calendar date deadline for making any of the notifications. After reaching your determination as to whether KCH experienced a breach, include your recommendations to the Board for corrective action to prevent a future occurrence. HIPAA Hypothetical Scenario You are the Privacy Official, PO, for Kickapoo Community Hospital, KCH, located in Kickapoo, Wisconsin. As the PO, part of your job descripBon is to invesBgate and respond to potenBal breach incidents to determine if KCh has breached paBent Protected Health InformaBon, PHI, under federal law, HIPAA, and Wisconsin state law. On May 17, 2020, you receive a call from the manager of the Hinky Dinky Grocery Store at Lake Okoboji, Iowa. The manager explains that one of her staff members found a thumb drive in the cereal aisle. The manager thinks the thumb drive may belong to KCH. She explains that she put the thumb drive into her computer and found what appeared to be the medical records of paBents from KCH. You arrange to have the Hinky Dinky manager securely mail the thumb drive back to your aRenBon. May 22, 2020, you receive the thumb drive and review the contents. Upon review, you confirm the thumb drive contains the PHI of 623 KCH cancer paBents. Upon further invesBgaBon, you have determined that the thumb drive belongs to a Dr. Schmidtlap. Dr. Schmidtlap is an oncologist employed by KCH. AWer interview Dr. Schmidtlap, you learn he was on vacaBon at Lake Okoboji with his family. He explains that he went to buy groceries for his family and recalls grabbing a grocery list out of his pocket. He admits that he had a thumb drive in his possession containing KCH paBent informaBon. He further explains that he was intending to do some work remotely while he had some downBme. He apologizes for what happened and thinks that he must have set the thumb drive down and forgot to put it back in his pocket as he did later realize he was not able to find it. For purposes of this hypotheBcal, assume from your review of the files for each paBent you discover the following informaBon—paBent name, paBent address, paBent date of birth, paBent account, paBent social security number, physician progress notes, nursing notes, treatment plan, diagnosis of cancer, medical imaging, and lab results. Assume that Wisconsin has a paBent privacy law that follows HIPAA (i.e., it is not more restricBve than HIPAA). Assume that KCH has privacy and security policies that follow HIPAA. Assume that all 623 paBents are residents of Wisconsin and the services were provided to these paBents enBrely within Wisconsin. Assume this incident is considered an “impermissible disclosure” under HIPAA for the purposes of this assignment. DraW an internal memo to the CEO and board of KCH that summarizes this parBcular issue. As part of your memo, include the following informaBon: 1. Brief background paragraph summarizing what occurred. Copyright © 2023 The University of Southern California 2. Apply the HIPAA four factor Breach NoBficaBon Rule risk assessment to the facts in this incident. Make a determinaBon assigning the following level of risk (1) high, (2) medium, or low, for each of the four factors in the assessment and idenBfy which facts were importan tot the risk level you assigned. Then, make an overall conclusion of whether you think this incident would be considered a Health InformaBon Technology for Economic and Clicnical Health (HITECH) breach under HIPAA, or not, based on your assigned risk levels for each of the four factors. 3. As a result of your determinaBon, determine whether any paBents need to be noBfied. Does the Office for Civil Rights (OCR) need to be noBfied? Should the local media need to be noBfied? For each of these audiences, include why you think a noBficaBon does or does not need to be made, and include the required calendar data deadline for making any of the noBficaBons. 4. AWer reaching your determinaBon as to whether KCH experienced a breach, include your recommendaBons to the Board for correcBve acBon to prevent a future occurrence. Use Times New Roman font, size 12, and make sure to double space it. Submit your essay as an aRachment. Your essay should be four to five pages.

ANSWER

Privacy Incident Summary and Recommendations

Date: [Current Date] To: CEO and Board of Kickapoo Community Hospital (KCH)

From: [Your Name] Privacy Official (PO), KCH

Brief Background

On May 17, 2020, Kickapoo Community Hospital (KCH) was alerted to a potential privacy breach incident. The manager of Hinky Dinky Grocery Store in Lake Okoboji, Iowa, contacted KCH, reporting the discovery of a thumb drive in the cereal aisle, which she suspected belonged to KCH. After reviewing the thumb drive’s contents, we confirmed that it contained the Protected Health Information (PHI) of 623 KCH cancer patients. Subsequent investigation revealed that the thumb drive belonged to Dr. Schmidtlap, an oncologist employed by KCH, who had inadvertently left it behind while on vacation. This incident constituted an “impermissible disclosure” under HIPAA.

HIPAA Four-Factor Breach Notification Rule Risk Assessment

We assessed the breach using the HIPAA four-factor Breach Notification Rule:

The Nature and Extent of PHI Involved

Risk Level: High

Key Factors: The compromised data included sensitive patient information, such as names, addresses, social security numbers, medical diagnoses, and treatment plans, putting patients at substantial risk for identity theft and harm.

The Unauthorized Person Who Used the PHI or to Whom the Disclosure Was Made

Risk Level: Medium

Key Factors: The thumb drive was found by an employee of Hinky Dinky Grocery Store, which is not associated with KCH. Although there is no evidence of malicious intent, the possibility of unauthorized access remains a concern.

Whether PHI Was Acquired or Viewed

Risk Level: Low

Key Factors: While the thumb drive was discovered, and its contents were accessed by Hinky Dinky’s manager, there is no indication that the patient data was viewed or used inappropriately by unauthorized individuals.

The Extent to Which the Risk to PHI Has Been Mitigated

Risk Level: Medium

Key Factors: Prompt retrieval of the thumb drive, Dr. Schmidtlap’s cooperation, and the absence of evidence of data misuse contribute to risk mitigation. However, the fact that the thumb drive contained sensitive patient information cannot be ignored.

Overall Conclusion: Given the high risk associated with the nature and extent of PHI involved and the medium risk related to the unauthorized person who accessed the PHI, we consider this incident to be a HITECH breach under HIPAA.

 Notification Determination

Patient Notification

Patients need to be notified due to the high-risk nature of the breach.

Deadline for Notification: Patients should be notified within 60 days of the discovery of the breach, making the deadline July 21, 2020.

Office for Civil Rights (OCR) Notification

The OCR must be notified because this is a HITECH breach.

Deadline for Notification: OCR must be informed within 60 days of the discovery of the breach, aligning with the patient notification deadline.

Local Media Notification

Media notification is not necessary in this case.

The breach does not meet the criteria that would necessitate media notification, as there is no evidence of unauthorized access or misuse of PHI.

Recommendations for Corrective Action

To prevent future incidents of this nature, the following corrective actions are recommended:

Reevaluate Mobile Data Storage: Review and update policies regarding the use of portable storage devices (e.g., thumb drives) for sensitive patient information. Implement encryption and access controls to protect data.

Employee Education: Conduct mandatory training sessions for all employees on data security, emphasizing the importance of safeguarding patient information and the potential consequences of data breaches.

Regular Audits: Implement periodic audits of employees’ compliance with data security policies and procedures. This will help identify and address potential vulnerabilities proactively.

Incident Response Plan: Review and enhance the incident response plan to ensure a swift and coordinated response to future breaches, including proper documentation, notification, and risk assessment.

In conclusion, the breach of patient information was a significant incident that requires immediate action to mitigate risk, fulfill notification requirements, and prevent similar occurrences in the future. We will work diligently to implement these recommendations and keep you updated on our progress. Your support and commitment to safeguarding patient data are essential in maintaining the trust of our community.

Sincerely,

[Your Name] Privacy Official (PO), KC