Explanation

Under HIPAA, a breach is defined as an impermissible use or disclosure of protected health information that compromises the security or privacy of the information. The intent behind the disclosure is not determinative — accidental disclosures can constitute breaches. In this scenario, the wrong prescription sent to the wrong pharmacy resulted in PHI (patient name and medication) being disclosed to an unauthorized person in the pharmacy waiting area. The Breach Notification Rule requires the covered entity to assess the breach, document it, notify the affected individual(s) without unreasonable delay, and report to HHS. The scale of the breach determines additional notification requirements (such as media notification for breaches affecting 500 or more individuals).

Key Takeaway

Accidental disclosures of PHI can constitute HIPAA breaches. Intent is not required. The covered entity must assess, document, and follow breach notification procedures.