• linkedin
  • Increase Font
  • Sharebar

    4 steps to take after suffering a data breach

    What to do if someone gets hold of valuable patient information.

    A data breach in the dental industry isn’t just nerve racking —it’s also expensive and it can potentially shut a practice down. The bad news is that nearly every practice will experience a data breach of some magnitude during the life of the practice. This guide helps you to identify the type and severity of a data breach.

    There’s a lot of confusion on what constitutes a breach in the healthcare industry. Under HIPAA, it’s presumed that an impermissible use or disclosure of protected health information (PHI) is a breach unless the covered entity or business associate demonstrates that there’s a low probability that the PHI was compromised.

    Related article: Is your website a HIPAA violation?

    To make that determination, HIPAA mandates that those organizations perform a risk assessment on at least the following four factors.

    1. Assess the nature and extent of involved PHI and likelihood of re-identification

    Hacking conceptWhen determining the risk of harm to an individual, it’s important to determine what information was exposed and the likelihood of re-identification. Take a closer look at the PHI that was inappropriately disclosed or used. Is it more sensitive in nature? Do they include financial records? What was the level of detail in the record? Assessing this information will help to mandate the urgency with which you deal with the issue.

    For example, you’ll feel far more pressed to deal with a breach in financial records than you will to deal with a breach in outdated information. Also, as we’ve discussed in previous articles, if you’ve encrypted the data and have evidence of this, then you can reasonably determine that there’s a very low risk of re-identification. On the flip side, HHS made a determination back in 2016 that suffering a ransomware attack is, by definition, a breach.

    This information is one step that will assist an office in determining if there’s a low risk that the PHI was compromised. However, all four factors must be considered before a determination is made.

    2. Determine the unauthorized person who used the PHI or to whom the disclosure was made

    The next step involves tracing the breach back to the source and identifying the perpetrator and/or the person to whom the information was disclosed. This often occurs as a mistake on the part of the employee.

    For example, an employee who meant to send an encrypted email file to a referring office may have mistakenly sent it to a different party or included unauthorized personnel in the email correspondence. If this is the case, then it’s fairly simple to trace it back to the source. From there, steps can be taken to reinforce policies to rectify the situation.

    Other times the impermissible use or disclosure involves a third party. Determining who received the PHI is an important factor, as it may weigh heavily toward a decision that the data had a low probability of being compromised. An email sent to another dentist is far better than one sent to the wrong patient!

    Related article: How to ensure your email is HIPAA compliant

    3. Establish whether the PHI was actually acquired or viewed

    The best-case scenario is that breached data is never viewed or acquired. This may happen, for example, if a laptop that was stolen or lost is returned but an unauthorized person never opened it. This is going to be a factor in determining if the PHI was compromised.

    Continue to page 2 to

    Dr. Lorne Lavine
    Dr. Lorne Lavine, founder and president of Dental Technology Consultants, has more than 30 years invested in the dental and dental ...


    Add Comment
    • No comments available