A nurse manager discovers that a hospital-issued laptop containing the protected health information (PHI) of 850 clients was stolen from an employee vehicle 8 days ago. The laptop was encrypted, but the encryption certificate was on a sticky note attached to the device. Which actions are required under the HIPAA Breach Notification Rule? Select all that apply.
Select All That Apply
Choose your responses, then check the answer.
Explanation
The HIPAA Breach Notification Rule applies because the attached encryption key makes the PHI readable and the incident affects 850 individuals. Option 1 is correct: a breach affecting more than 500 residents of a state or jurisdiction requires notice to prominent local media. Option 2 is correct: the Secretary of HHS must be notified without unreasonable delay and no later than 60 days. Option 3 is correct: because contact information is insufficient for 15 people, substitute notice must be posted conspicuously on the website for at least 90 days or placed in major print or broadcast media, with a toll-free number active for at least 90 days. Option 4 is correct: the entity must document its breach determination and the four-factor risk assessment concerning the probability that PHI was compromised. Option 5 is correct: affected individuals must be notified without unreasonable delay and no later than 60 calendar days after discovery. Option 6 is incorrect because waiting for a quarterly meeting could violate the notification deadline.
HIPAA Breach Notification — When Greater Than 500 60-day deadline + individual notice + HHS report + media notice + 90-day contact line. All are simultaneously required.
Encryption Safe Harbor Encrypted PHI is generally not a reportable breach — but here the encryption certificate was physically with the device, so the safe harbor is lost and compromise is presumed.
Four-Factor Risk Assessment 1. Nature and extent of PHI 2. Who used or received it 3. Was it actually acquired or viewed 4. Mitigation steps
NCSBN Theme MOC — Confidentiality / Information Technology / Legal Responsibilities.
ScenarioHospital laptop stolen from an employee vehicle 8 days ago.
Scope- 850 individuals with PHI on the laptop- Contact information is insufficient or out of date for 15 affected individuals- Device was encrypted, but the encryption certificate was attached to it
Status- Within the 60-day notification window- Encryption safe harbor does not apply because the key was attached
TriggerAt least 500 affected individuals requires individual, HHS, and media notification; missing contact information for at least 10 also triggers substitute notice.
HIPAA Breach Notification Rule — 45 CFR Part 164 Subpart D — the federal rule requiring covered entities and business associates to notify affected individuals, HHS, and (when greater than 500 in a state or jurisdiction) the media within specific timelines. Standard timeline: 60 calendar days from discovery for individual notice. Smaller breaches go on the annual log.
Encryption safe harbor — Under HIPAA, properly encrypted PHI rendered unusable, unreadable, or indecipherable to unauthorized persons is generally not a breach. Safe harbor is lost when the encryption key is co-located with the encrypted device (sticky note, file stored on the device, default password unchanged).
Four-factor risk assessment — Required documentation when compromise of PHI is uncertain: (1) nature and extent of PHI involved (sensitivity), (2) unauthorized person who used or received PHI, (3) whether PHI was actually acquired or viewed, (4) mitigation efforts. Compromise is presumed unless the four factors demonstrate low probability of compromise.