Title: Identify different types of data breaches.
Course: Health Informatics (14157-I) > Section: Exploring Laws and Requirements Regarding Data Breaches

Identification should include

- definition of the term breach, which should include
  - the nature and extent of the protected health information (PHI) involved, including the kinds of identifiers and the likelihood of re-identification
  - the unauthorized person who used the PHI or to whom the disclosure was made
  - whether the PHI was actually acquired or viewed
  - the extent to which the risk to the PHI has been mitigated
  - misuse of social media platforms

- exceptions to the definition of breach, such as
  - unintentional acquisition, access, or use of PHI by a workforce member acting in good faith under authority of a covered entity
  - the inadvertent disclosure of PHI by a person authorized by a covered entity
  - the good-faith belief that the unauthorized person to whom the disclosure was made would not have been able to retain the information.

Teacher Resource: Office for Civil Rights (OCR) (https://www.hhs.gov/ocr/index.html), U.S. Department of Health and Human Services

Process/Skill Questions:

- What is the economic impact to the healthcare industry of data breaches?
- What is the leading cause of healthcare-related data breaches?
- How are employees educated about the economic and legal ramifications of data breaches?
- Which law covers the reporting of breaches related to healthcare information?