Jane and Martha are friends having lunch when Martha in general conversation says to Jane, "I hope your mom's lab test come back ok"  Martha is the contracted bookkeeper  at Jane's mom Dr office. The assumption is Martha meant no harm in the statement during the conversation yet this is a breach of  Jane's mom privacy. In addition Martha doesn't know the type of blood work and didn't see the record but rather the billing transactions.  After finishing lunch Jane calls her mom being curious about the blood work she had done. Now Jane's mother feels uncomfortable because she didn't share with her daughter since she didn't want to worry her. This situation could spiral out of control with Jane's mom calling the Dr office upset about her daughter being aware of her medical treatment.  How should this situation be handled?  

HIPAA  privacy rule was violated. Martha is considered a Business Associate to the Covered Entity, the Dr. Office. According to HIPAA changes in 2013 Martha and the doctor should have signed  Business Associate Agreement terms ensuring both parties understand HIPAA privacy obligation and liabilities. In this situation with Jane's mother  a factor of harm has to be weighted and the appropriate action taken which must include  mitigating potential of future cases.  In situations when more than one individuals information is breached the cost to administer a breach process which includes reporting to HHS and state agencies along with  penalties can grow for both the Covered Entity and Business Associate.

Key to keeping the cost down is ensuring the signed terms of agreement are clear between parties, periodic evaluations of business practices and open communication relative to gray area/situations. 

The trend of moving from paper to digital  has moved from the large medical practices to smaller organizations. Dentist, chiropractors, holistic doctors, and acupuncturist are gaining significant return on investment that allows them to downsize their office space and/or expand their practice.  While organization are doing research on what digital solutions to use like BOX with the Snap-File solution there are still requirements to ensure daily practices and employees are meeting  HIPAA/HITECH security requirements. These organizations are establishing policy and practices for HIPAA HITECH safeguards and working to schedule risk assessments. A question we've been asked is "In an operation of one or two people, who is the Security Officer?"   What's more important than that who holds the position is are the necessary controls  to be in place and being managed to ensure  PHI (personal health information) data is protected.