Who Else Finds Out When Health Records Leak

Answer first: the letter to you is one of four channels

A breach notice to an individual is the visible part of a system with several outputs.

Under the federal health privacy rules the same event can also require notice to prominent media outlets, notice to the Secretary, and notice travelling upstream from one company to another.

Each of those has its own trigger, and the triggers use different numbers. They are close enough to look identical and far enough apart to produce different outcomes on the same facts.

Reading them side by side is the fastest way to see why a breach can be reported and still never appear anywhere you would look.

The media rule, and the number written into it

The rule is short. For a breach of unsecured protected health information involving more than five hundred residents of a State or jurisdiction, a covered entity must notify prominent media outlets serving that State or jurisdiction.

The unit is residents of one State, not people overall. A breach touching thousands of people spread thinly across the country can fail that test everywhere.

Timing matches the individual notice. Notice goes out without unreasonable delay and in no case later than sixty calendar days after discovery, subject to the law enforcement exception.

Content matches it too. The media notification has to meet the same content requirements as the notice sent to individuals, so the same five elements apply.

The consumer-facing rule has a media provision of its own, and its threshold is written differently. It applies where the information of five hundred or more residents of a State or jurisdiction is, or is reasonably believed to have been, acquired.

More than five hundred, and five hundred or more, are not the same test. They separate at exactly one number.

The regulator, and the two speeds

Notice to the Secretary is required for every breach of unsecured protected health information, without a size threshold. What size decides is when.

For a breach involving five hundred or more individuals, the covered entity provides that notice contemporaneously with the notice to individuals, in the manner specified on the department's website.

For a breach involving fewer than five hundred individuals, the entity keeps a log or other documentation. It reports not later than sixty days after the end of each calendar year, for breaches discovered during the preceding year.

That second route is the one worth understanding. A small breach discovered in January can be reported in a batch the following March, entirely lawfully.

The consumer-facing rule sets the same two speeds toward the Commission instead. Five hundred or more is contemporaneous, and a log of anything smaller may be sent annually no later than sixty calendar days after the end of the calendar year.

The public list, and a third number

There is a statutory duty to publish, and it is worth reading closely because it is narrower than the reporting duty above it.

The Secretary must make available to the public, on the department's website, a list identifying each covered entity involved in a qualifying breach. It qualifies where the unsecured protected health information of more than five hundred individuals is acquired or disclosed.

So three thresholds sit within one system. Notice to the Secretary is due for any breach. Contemporaneous notice is due at five hundred or more. Publication is required at more than five hundred.

A breach affecting exactly five hundred individuals falls in the gap. It is reported at once and, on the face of the statute, is not within the publication duty.

The statute also asks for counting of a different kind. It directs an annual report to named congressional committees covering breaches for which notice was given to the Secretary, including the number and nature of those breaches and the actions taken in response.

Between the list and the report there is a real distinction. One names entities above a threshold; the other counts everything reported and does not name anyone.

The notice that travels between companies

Records are often held by a company you have never dealt with, and the rules build a link for that case.

A business associate that discovers a breach of unsecured protected health information must notify the covered entity of it. Discovery is imputed the same way it is for a covered entity, through any employee, officer or other agent other than the person committing the breach.

The timing is the same sixty-day ceiling, running from the business associate's own discovery rather than from the covered entity's.

The content requirement is the part with practical weight. The notification must include, to the extent possible, the identification of each individual whose information has been or is reasonably believed to have been accessed, acquired, used or disclosed during the breach.

It must also supply any other available information the covered entity needs for its own notice to individuals, either at the same time or promptly as it becomes available.

The consumer-facing rule has a matching link for the companies inside its scope, running from a service provider up to the vendor or related entity it serves.

The delay that can hold all of it

One section can stop every notice in the subpart, and it is only a paragraph long.

If a law enforcement official states that a notification, notice or posting required under the subpart would impede a criminal investigation or cause damage to national security, the entity must delay it.

How long depends on the form the statement takes. Where the statement is in writing and specifies the time for which a delay is required, the entity delays for the period the official specified.

Where it is made orally, the entity documents the statement, including the identity of the official making it, and delays temporarily for no longer than thirty days from the date of the oral statement.

That thirty-day cap lifts only if a written statement arrives within the period. The consumer-facing rule carries the same exception and implements it by pointing at a provision of the health privacy rules.

It is a narrow power with a written record attached, and it is the reason a notice can arrive much later than the deadlines above would suggest.

Who acts on the consumer-facing rule

The rule states its own enforcement route rather than leaving it to inference.

Any violation of the part is treated as a violation of a rule promulgated under section eighteen of the Federal Trade Commission Act, regarding unfair or deceptive acts or practices. It is subject to civil penalties adjusted for inflation.

The section then says the Commission will enforce the part in the same manner, by the same means, and with the same jurisdiction, powers and duties available to it under that Act.

The statute behind the rule says the same thing in its own words, treating a violation as an unfair and deceptive act or practice in violation of a regulation under that section.

There is also a bridge between the two agencies that most descriptions leave out. On receiving a breach notification, the Commission notifies the Secretary of it.

One more feature of that statute is printed in its own title. It calls itself a temporary requirement, and the section provides that it stops applying if Congress enacts new legislation covering the same ground.

What federal law leaves to the states

The health privacy rules include a preemption section, and it is written as a general rule with a closed list of exceptions.

The general rule is that a standard, requirement or implementation specification adopted under the subchapter that is contrary to a provision of State law preempts that provision.

Contrary has its own definition, and it is a two-part test. Either a covered entity or business associate would find it impossible to comply with both. Or the State provision stands as an obstacle to the accomplishment and execution of the full purposes and objectives of the federal scheme.

Four conditions then take a State provision out of the general rule. A determination by the Secretary on named grounds. A provision whose principal purpose is regulating controlled substances. A provision for reporting disease or injury, child abuse, birth or death, or for public health surveillance, investigation or intervention. And a provision for health plan reporting for audits, program monitoring or licensure.

The fifth is the one everybody quotes, and it is worth reading letter by letter. It covers a State provision that relates to the privacy of individually identifiable health information and is more stringent than a standard, requirement or implementation specification adopted under subpart E of part 164.

Subpart E is the privacy rule. The breach notification rules are subpart D, and the definition of more stringent in the neighboring section is written against subpart E by name as well.

The consumer-facing rule points at the same machinery, stating that it preempts State law as set out in a named section of the statute behind it.

So the honest reading is a limit rather than a conclusion. The text sets out one general rule and a closed list of exceptions, and which of them reaches a State breach notification statute is not answered on the face of it.

What a reader can actually look at

Whether a company's privacy document names the entity that holds the record, since the upstream notice runs between companies and the one you contracted with may not be the one holding it.

Whether the document says anything about which vendors receive health information, because that is the population the business associate link is built for.

Whether a notice you receive names a State, since the media and publication duties are counted by residents of a State rather than by people overall.

Whether a notice explains its own timing, since a late letter can be lawful under the delay provision and there is no way to tell from the letter unless it says so.

And whether a company publishes any privacy contact at all. Every route described here starts with knowing which organization to ask.

What this does not decide

It does not say which federal rule reaches any particular company, or that either one does. That is a legal conclusion about a specific business.

It does not say that any company has experienced a breach, appeared on any list, or delayed any notice. No such claim is made and none is implied.

It does not describe what the department's public list currently contains, and it gives no address for it. What is described is the statutory duty to publish one.

It does not say whether any State notification statute survives preemption, because the text quoted here does not answer that question.

And it is not legal advice. It reports what four sections of a federal rule, two preemption sections and two statutes say.