Include this information as part of your risk analysis. Knowing what doesn't count as a breach under new HIPAA notification rules can help you weigh whether to report a disclosure of unsecured protected health information. The rules, which went into effect on Sept. 23, include four exceptions, as follows: Exception No. 1.
Example:
A nurse handed a doctor the wrong patient folder but immediately retrieved it, or the doctor returned the folder unused.Exception No. 2.
An inadvertent breach where a nurse, for example, gives another nurse information that the second nurse shouldn't have, but there's no reasonable risk of further use or misuse of the PHI. "Here, each party has authority to access PHI at the same location, but not necessarily the PHI at issue," says Solley.Exception No. 3: A disclosure that occurs when the covered entity has a good faith belief that an unauthorized person (such as the recipient of a fax) would not retain the information "because in a follow-up call, the recipient agreed to destroy the fax," Solley notes.
Exception No. 4:
Disclosure, access, or use of PHI involving a limited data set that excludes both birth dates and zip code information.