Discussion of pt. PHI with others Willful neglect in discussing Accessing, disclosing and /or Discussing pt. PHI for work purposes yet in an area patient care/situations with amending PHI or Hospital (wrongfully where overheard by others. health care or other individuals information for malicious purposes discussing or (low level of harm to pt and/or without a to know”. (low or personal gain. “need when overhead in no breach notification required) level of harm to patient and/or an unsecure area) no breach notification required) Leaving a message for a Leaving a message for a Willful neglect in leaving a patient/parent that exceeds the patient/parent that exceeds the message for a patient/parent minimum necessary standards minimum necessary standards that exceeds the minimum Leaving message (no risk of harm to patient and (second offense and no risk of necessary standards (first no reporting requirement) harm to patient and no offense, low harm to patient, no reporting requirement) reporting requirement). May include highly confidential PHI (Behavioral, STD, substance abuse, HIV/AIDS, etc.) Publication or presentation of Publication or presentation of PHI without patient PHI without patient Publication or authorization (low or no harm to authorization (significant harm presentation PHI patient) to patient and breach notification). NOTE: if Research report to IRB. – Use of PHI for identity theft or obtaining and or using) financial ID Theft/Fraud information (credit card, etc.), (significant harm to patient) Not properly Not properly verifying Willful neglect in not properly Willful neglect in not properly verifying individual’s identification before verifying individuals by phone, verifying individuals by in identification disclosing information, whether in person or in writing (low or person or in writing (significant (e.g.: giving by phone, in person or in no harm to patient and no harm to patient and breach document with writing. (no harm to patient) breach notification) before notification) before disclosing PHI to wrong disclosing information. information. person; leaving PHI message on wrong phone)
Discussing pt. PHI (wrongfully discussing or when overhead in an unsecure area) Discussion of pt. PHI with others for work purposes yet in an area where overheard by others. (low level of harm to pt and/or no breach notification required) Willful neglect in discussing patient care/situations with health care or other individuals without a “need to know”. (low level of harm to patient and/or no breach notification required) Accessing, disclosing and /or amending PHI or Hospital information for malicious purposes or personal gain. Leaving message Leaving a message for a patient/parent that exceeds the minimum necessary standards (no risk of harm to patient and no reporting requirement) Leaving a message for a patient/parent that exceeds the minimum necessary standards (second offense and no risk of harm to patient and no reporting requirement) Willful neglect in leaving a message for a patient/parent that exceeds the minimum necessary standards (first offense, low harm to patient, no reporting requirement). May include highly confidential PHI (Behavioral, STD, substance abuse, HIV/AIDS, etc.) Publication or presentation PHI Publication or presentation of PHI without patient authorization (low or no harm to patient) Publication or presentation of PHI without patient authorization (significant harm to patient and breach notification). NOTE: if Research – report to IRB. ID Theft/Fraud Use of PHI for identity theft or obtaining and or using) financial information (credit card, etc.), (significant harm to patient) Not properly verifying identification (e.g.: giving document with PHI to wrong person; leaving PHI message on wrong phone) Not properly verifying individual’s identification before disclosing information, whether by phone, in person or in writing. (no harm to patient) Willful neglect in not properly verifying individuals by phone, in person or in writing (low or no harm to patient and no breach notification) before disclosing information. Willful neglect in not properly verifying individuals by in person or in writing (significant harm to patient and breach notification) before disclosing information.