HIPAA regulations require Covered Entities and their Business Associates to investigate and mitigate any security or other incidents that involve potential unauthorized access of Protected Health Information (PHI). Except in very limited instances, any unauthorized access to a Covered Entity\u2019s PHI constitutes a breach. Breaches impacting 500 or more individuals must be reported to the U.S. Department of Health & Human Services (HHS), the media and the impacted individuals within 60 days of discovery. Breaches impacting fewer than 500 individuals must be reported to the impacted individuals within 60 days of discovery and reported on an annual basis to HHS.<\/p>\n\n\n\n
The University of Texas at Dallas is a Covered Entity and is required to comply with these regulations. It is the policy of the University to comply with these regulations at all times. This policy applies to all University officers, faculty, staff, students, volunteers, or any other individual or contractor who provides services to or conducts business on behalf of the University.<\/p>\n\n\n\n
Definitions:<\/h2>\n\n\n\n
Breach Notification<\/strong> \u2013 An acquisition, access, Use, or Disclosure of PHI is presumed to be a breach unless the Center or business associate, as applicable, demonstrates that there is a low probability that the PHI has been compromised based on a risk assessment of at least the following factors:<\/p>\n\n\n\n
a) The nature and extent of the PHI involved, including the types of identifiers and the likelihood of re-identification;<\/p>\n\n\n\n
b) The unauthorized person who used the PHI or to whom the disclosure was made;<\/p>\n\n\n\n
c) Whether the PHI was actually acquired or viewed; and<\/p>\n\n\n\n
d) The extent to which the risk to the PHI has been mitigated.<\/p>\n\n\n\n
Incident <\/strong>\u2013 any act, such as an unauthorized Use or Disclosure, or any other occurrence that could reasonably involve PHI and indicates that a Breach has occurred.<\/p>\n\n\n\n
Responsibility to Notify University Officials<\/h2>\n\n\n\n
1. All individuals covered by this policy are required to report possible Incidents of advertent or inadvertent disclosure to the HIPAA Privacy Officer IMMEDIATELY upon discovery. Examples include:<\/p>\n\n\n\n
Accessing and reading medical records out of curiosity<\/li>
Faxing a patient\u2019s information to the wrong person or agency<\/li>
Improper disposal of patient information<\/li><\/ul>\n\n\n\n
![\"\"](\"https:\/\/calliercenter.utdallas.edu\/wp-content\/uploads\/2022\/10\/zimmerman.png\")
<\/figure>\n\n\n\n