Pathology/Lab Coding Alert

Question: An employee at our lab accessed records without a legitimate reason. He didn’t tell anyone about any of the information he accessed. Is this still a reportable breach incident, even though the information didn’t leave our lab?

Codify Subscriber

Answer: To determine the answer, you must go back to the definition of a breach, which is any acquisition, access, use or disclosure in violation of the HIPAA Privacy Rule, says Jim Sheldon-Dean, founder and director of compliance for Lewis Creek Systems LLC in Charlotte, VT.

In this situation, “somebody looked at the information who wasn’t supposed to look at the information,” Sheldon-Dean notes. That would be an “access” or a “use.”

But “minimum necessary” Privacy Rule requirements dictate that people should access only the information that they should access. A person accessing information that they should not violates the minimum necessary requirements, Sheldon-Dean explains. “So that would be a reportable breach even though the information didn’t leave your facility — it was a breach within your facility.”