SNF Privacy Breaches: Build the Assessment and Notification Population

Preserve the facts before choosing the outcome

An admissions export goes to the wrong external address. Staff disable the link and receive a message saying the file was deleted. The privacy case is still missing important facts: what was accessible, whether the link required authentication, whether the file was downloaded, and which residents appeared in it.

The HHS Breach Notification Rule guidance explains the presumption following an impermissible use or disclosure, the assessment of a low probability that PHI has been compromised and defined exceptions. It identifies four assessment factors. Federal notification duties concern breaches of unsecured PHI: the team must assess whether the information was rendered unusable, unreadable or indecipherable to unauthorized people under the Secretary's specified methods. A generic claim that a system uses encryption does not establish the status of the exposed export. The determination belongs to the qualified privacy and legal response team; a vendor's incident severity label is not that determination.

Preserve the original file securely, its version and fields, the destination, relevant message and access evidence, discovery chronology and containment actions. Avoid repeatedly forwarding the exposed information to investigate it. Record which facts are confirmed, supplied by another party or unknown.

Build an assessment that shows uncertainty

This original worksheet uses the misdirected-export example.

Assess the rule's exceptions against their actual conditions rather than using “accidental” as a blanket exclusion. The guidance also permits providing required notifications without performing the low-probability assessment. Record the selected path and supporting rationale. A case that concludes notification is not required still needs the relevant evidence and reasoning.

Count people, then apply each threshold

Suppose the export has 620 rows. Deduplication shows 540 unique affected individuals: 310 residents of State A and 230 residents of State B. On those hypothetical facts, the Secretary's 500-or-more-individual threshold is met. Neither state's count exceeds 500 for the federal media threshold. Row count, current facility census and affected individuals are three different populations.

If another file adds people, recompute the combined population and avoid double counting. Record residence information needed for the applicable state or jurisdiction assessment; do not infer it solely from the facility address. The team must also evaluate state breach laws, other relevant law and actual contractual duties, which can use different definitions and deadlines.

Under the federal guidance, individual notices are due without unreasonable delay and no later than 60 days after discovery, subject to applicable provisions. Breaches affecting 500 or more individuals have the corresponding prompt Secretary notification requirement; breaches affecting fewer than 500 individuals must be reported to the Secretary no later than 60 days after the end of the calendar year in which they were discovered. Media notice applies to breaches affecting more than 500 residents of a state or jurisdiction. A business associate must notify the covered entity without unreasonable delay and no later than 60 days after discovery; contracts may require earlier operational notice. None of these maximum periods is a reason to wait after the required facts are ready.

Reconcile every required notice

Create one protected population table with a stable incident-person key. Track the relevant notice recipient, contact verification, delivery method, date, returned mail or failed delivery, substitute-notice review and completion evidence. Keep HHS and media submissions in separate records tied to their triggering populations. Do not mark a resident notified merely because an address was exported to a mailing service.

A fictional reconciliation might show 540 individuals in scope, 526 ordinary notices completed and 14 requiring additional handling because contact information is insufficient. The unresolved 14 remain visible until the prescribed next steps are documented. Because at least 10 individuals have insufficient contact information, the federal substitute-notice branch calls for a website home-page notice for at least 90 days or notice in major print or broadcast media where those individuals likely reside, plus a toll-free number active for at least 90 days. This substitute individual notice is separate from the state-level media threshold above. Content review should cover the required description of the incident, information involved, protective steps, facility response and contact procedures as applicable.

Make suppliers support the investigation

Before contracting, establish how the supplier can provide affected-record populations, event timing, retained logs and the limits of its observations. Ask for a synthetic incident exercise in which the supplier corrects its initial count. The facility should be able to update the assessment and notice population while preserving earlier versions.

The acceptance result is an explainable case file and a reconciled notification process. It is not a promise that a security tool can automatically decide whether an event is a reportable breach.