Failure to encrypt with PHI Failure to encrypt email with PHI Willful neglect in failing to included or as an attachment, included or as an attachment, encrypt email with PHI included Unsecured email sent to a non- network address. sent to a network address. or as an attachment, sent to a (low or no harm to patient) (significant harm to patient) network address. ACCESS Willful neglect - Accessing own Access own PHI medical records/PHI Accessing HIGHLY confidential PHI Family records Willful neglect in accessing under false pretenses, without family members records having a working need to do so. offense, both PHI and specific (Behavioral, STD, family planning, High confidential, protected information such as substance abuse, HIV/AIDS, etc. pt, empl/business (Behavioral, STD, family considered HIGHLY Confidential) info for personal planning, substance abuse, Accessing, disclosing and /or gain/malicious HIV/AIDS, etc.) and the potential amending PHI of a patient without intent for harm does exist as a result) having a job duty - reason to do so, or confidential employee/hospital information for personal /professional gain or malicious intent to sell or harm others. Access patientPHI Accessing the record of a patient Willful neglect in accessing, with no working without having a job disclosing, and/or amending PHI job need to know duty/working reason to do so duty/working reason to do so (includes (low or no harm to patient resulting in potential significant employee/patient and/or no reporting required) harm to patient. (Including but not PHI) (elect. Record, limited to behavioral, STD, family “Snooping” documents, etc.) planning, substance HIV/AIDS, etc.) Requesting another user or Request other Request another user or employee to access patient user to obtain PHI employee to share (verbalize) information outside of his/her PHI of any patient. access ability or job duties (first offense) (elect. record, papers)
Unsecured email Failure to encrypt with PHI included or as an attachment, sent to a non- network address. (low or no harm to patient) Failure to encrypt email with PHI included or as an attachment, sent to a network address. (significant harm to patient) Willful neglect in failing to encrypt email with PHI included or as an attachment, sent to a network address. ACCESS Access own PHI Willful neglect - Accessing own medical records/PHI Family records High confidential, pt, empl/business info for personal gain/malicious intent Willful neglect in accessing family members records offense, both PHI and specific protected information such as (Behavioral, STD, family planning, substance abuse, HIV/AIDS, etc.) and the potential for harm does exist as a result) Accessing HIGHLY confidential PHI under false pretenses, without having a working need to do so. (Behavioral, STD, family planning, substance abuse, HIV/AIDS, etc. considered HIGHLY Confidential) Accessing, disclosing and /or amending PHI of a patient without having a job duty - reason to do so, or confidential employee/hospital information for personal /professional gain or malicious intent to sell or harm others. Access patientPHI with no working need to know (includes employee/patient PHI) Accessing the record of a patient without having a job duty/working reason to do so (low or no harm to patient and/or no reporting required) “Snooping” (elect. Record, documents, etc.) Willful neglect in accessing, disclosing, and/or amending PHI job duty/working reason to do so resulting in potential significant harm to patient. (Including but not limited to behavioral, STD, family planning, substance HIV/AIDS, etc.) Request other user to obtain PHI Request another user or employee to share (verbalize) PHI of any patient. Requesting another user or employee to access patient information outside of his/her access ability or job duties (first offense) (elect. record, papers)