Medical Records and the Law

HIPAA Security Rule 465to ePHI must be made aware of a covered entity’s security policies, buta covered entity is not required to provide training to business associatesor anyone else who is not a member of its workforce. Covered entitiestherefore may, but are not required to, train vendors, independent contractors,temporary personnel, and consultants. Given this requirement,a covered entity should consider what information it will give these individualsand what documentation of receipt, if any, it will require.Security IncidentsA “security incident” is “the attempted or successful unauthorized access,use, disclosure, modification, or destruction of information, or interferencewith system operations in an information system.” 90 The rulerequires a covered entity to establish policies and procedures for respondingto and reducing the harmful effects, if any, of a security incident.91 A covered entity’s risk assessment and security managementprograms should identify security incidents, document their occurrenceand their outcomes, and provide direction for managing them. 92 TheSecurity Rule permits, but does not require, covered entities to reportsecurity incidents to outside parties. Such reporting will depend upon acovered entity’s business operations and other legal requirements towhich it is subject (for example, local or state reporting requirements). 93Contingency PlanningCovered entities are required to develop a security contingency plan—which includes a data backup plan, a disaster recovery plan, and anemergency mode operation plan—and to address the need for an applicationsand data criticality analysis and testing and revision procedures.94 DHHS views this requirement as the “only way” to protect the“availability, integrity, and security of data” during unexpected events orcrises. The agency suggests that each covered entity determine its ownpotential risks in the event of an emergency that results in a loss of operations.95 Each covered entity is permitted to design its contingency9045 C.F.R. § 164.304.9145 C.F.R. § 164.308(a)(6)(i).9245 C.F.R. § 164.308(a)(6)(ii).9368 Fed. Reg. 8350 (Feb. 20, 2003).9445 C.F.R. § 164.308(a)(7).9568 Fed. Reg. 8351 (Feb. 20, 2003).