1

I'm wondering if sending snail mail to the wrong address could ever be a violation of HIPAA? Obviously, due to people moving and not updating their account information, this likely happens all the time

However, what if an insurance member has requested an address change from the insurance company (multiple times) but the company fails to update their address in the system and continues to send documents (Explanations of Benefits) to the wrong address?

Improve this question
3
  • 1
    The person opening the mail would be guilty of a crime. – Ron Beyer Feb 12 '19 at 23:12
  • @RonBeyer interesting... However, does that absolve the company of liability? If a hacker discovers that a database is in-secured & unencrypted, it would be a crime for them read the data... however, the company has still not done it's job to protect the data and would be in violation of HIPAA compliance. – NSjonas Feb 13 '19 at 1:04
  • No, it does not absolve them of liability in that regard. In your example, both the hacker and the company would be held responsible for different violations. I'm not sure though that the health provider would be liable if it were not given due notice of an address change. The responsibility to report that falls on the individual, not the provider. If they ignore the document, that is a different scenario. – Ron Beyer Feb 13 '19 at 1:49
3

Under 45 CFR 164.402 a "breach" is

the acquisition, access, use, or disclosure of protected health information in a manner not permitted under subpart E of this part which compromises the security or privacy of the protected health information.

Disclosing PHI to random people is not permitted under subpart E. Then then allow that it can be deemed to not be a breach if they can "demonstrate[] that there is a low probability that the protected health information has been compromised based on a risk assessment of certain factors – there isn't any clear yes/no rule as to how you could say that disclosing PHI is not a breach.

If they discover a breach, they must notify the affected individual. One ploy would be for them to stick their heads in the sand and be careful to not discover: but §164.404(2) says

A covered entity shall be deemed to have knowledge of a breach if such breach is known, or by exercising reasonable diligence would have been known, to any person, other than the person committing the breach, who is a workforce member or agent of the covered entity

So if, for example, they had been told that person X has moved, a reasonably diligent person would know that sending PHI to the old address will result in a breach. The Sec'y of HHS must also be notified of the breach, though this can go in the annual report if the breach involves fewer than 500 people. The affected individual can also file a complaint with HHS.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.