{"id":2631,"date":"2014-06-04T13:57:37","date_gmt":"2014-06-04T17:57:37","guid":{"rendered":"http:\/\/www.healthguardsecurity.com\/?p=2631"},"modified":"2020-09-08T14:20:47","modified_gmt":"2020-09-08T18:20:47","slug":"a-breach-notification-loop-hole-for-hipaa-covered-entities","status":"publish","type":"post","link":"https:\/\/www.healthguardsecurity.com\/a-breach-notification-loop-hole-for-hipaa-covered-entities\/","title":{"rendered":"A breach notification loop-hole for HIPAA covered entities"},"content":{"rendered":"<p>According to the <a href=\"http:\/\/www.ncsl.org\/research\/telecommunications-and-information-technology\/security-breach-notification-laws.aspx\" target=\"_blank\" rel=\"noopener noreferrer\">National Conference for State Legislatures (NCSL) website<\/a>, there are currently forty-seven states with breach notification laws. <!--more-->For the most part the laws are fairly similar in that they require organizations to notify individuals when their <a href=\"http:\/\/en.wikipedia.org\/wiki\/Personally_identifiable_information\">Personally Identifiable<span style=\"text-decoration: underline;\">&nbsp;<\/span>Information (PII)<\/a> has been compromised. Many also include exemptions for organizations that are already covered by the breach notification requires of <a href=\"http:\/\/en.wikipedia.org\/wiki\/Gramm%E2%80%93Leach%E2%80%93Bliley_Act\" target=\"_blank\" rel=\"noopener noreferrer\">GLBA<\/a>&nbsp;and\/or&nbsp;<a href=\"http:\/\/www.hhs.gov\/ocr\/privacy\/\" target=\"_blank\" rel=\"noopener noreferrer\">HIPAA<\/a>. On the surface preventing an overlap of federal and state breach <img loading=\"lazy\" decoding=\"async\" data-src=\"http:\/\/cdn.ttgtmedia.com\/ITKE\/uploads\/blogs.dir\/161\/files\/2012\/09\/data-breach.jpg\" width=\"195\" height=\"146\" class=\"alignright lazyload\" src=\"data:image\/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==\" style=\"--smush-placeholder-width: 195px; --smush-placeholder-aspect-ratio: 195\/146;\"><noscript><img loading=\"lazy\" decoding=\"async\" src=\"http:\/\/cdn.ttgtmedia.com\/ITKE\/uploads\/blogs.dir\/161\/files\/2012\/09\/data-breach.jpg\" width=\"195\" height=\"146\" class=\"alignright\"><\/noscript>notification laws seems logical, but in reality, this provides a gap in legal protections for some individuals&#8217; privacy. This gap is created by the difference in the type of data that each law covers. &nbsp;HIPAA and the associated Breach Notification requirements only cover <a href=\"http:\/\/www.hrsa.gov\/healthit\/toolbox\/HealthITAdoptiontoolbox\/PrivacyandSecurity\/underhipaa.html\">Personal Health Information (PHI)<\/a>, and not <em>generic<\/em> PII. As mentioned before, because many state breach laws exempt HIPAA covered entities entirely they are&nbsp;not required to notify individuals if their PII has been compromised. One group that this could affect is the organization&#8217;s&nbsp;employees and contractors, whose personal information is typically&nbsp;stored in payroll and HR systems.&nbsp;While we would hope that most, if not all, organizations confronted with this type of issue would still do the right thing by providing notifications, I would guess there may be a few that would decide to take the easy way.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<h3>Disclaimer<\/h3>\n<p><span style=\"color: #3e3e3e;\">The materials available at this web site are for informational purposes only and not for the purpose of providing legal advice. You should contact your attorney to obtain advice with respect to any particular issue or problem.<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>According to the National Conference for State Legislatures (NCSL) website, there are currently forty-seven states with breach notification laws.<\/p>\n","protected":false},"author":3,"featured_media":8075,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_bbp_topic_count":0,"_bbp_reply_count":0,"_bbp_total_topic_count":0,"_bbp_total_reply_count":0,"_bbp_voice_count":0,"_bbp_anonymous_reply_count":0,"_bbp_topic_count_hidden":0,"_bbp_reply_count_hidden":0,"_bbp_forum_subforum_count":0,"content-type":"","footnotes":""},"categories":[1],"tags":[142,29,21,30,7,75,48],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v22.5 (Yoast SEO v22.5) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>A breach notification loop-hole for HIPAA covered entities | HealthGuard<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.healthguardsecurity.com\/a-breach-notification-loop-hole-for-hipaa-covered-entities\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"A breach notification loop-hole for HIPAA covered entities\" \/>\n<meta property=\"og:description\" content=\"According to the National Conference for State Legislatures (NCSL) website, there are currently forty-seven states with breach notification laws.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.healthguardsecurity.com\/a-breach-notification-loop-hole-for-hipaa-covered-entities\/\" \/>\n<meta property=\"og:site_name\" content=\"HealthGuard\" \/>\n<meta property=\"article:published_time\" content=\"2014-06-04T17:57:37+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2020-09-08T18:20:47+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.healthguardsecurity.com\/wp-content\/uploads\/pexels-torsten-dettlaff-193003-scaled.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"2560\" \/>\n\t<meta property=\"og:image:height\" content=\"1707\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Apolonio Garcia\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@healthguardsec\" \/>\n<meta name=\"twitter:site\" content=\"@healthguardsec\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.healthguardsecurity.com\/a-breach-notification-loop-hole-for-hipaa-covered-entities\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.healthguardsecurity.com\/a-breach-notification-loop-hole-for-hipaa-covered-entities\/\"},\"author\":{\"name\":\"Apolonio Garcia\",\"@id\":\"https:\/\/www.healthguardsecurity.com\/#\/schema\/person\/19e63e3e2ab94d82417a803ec8e06430\"},\"headline\":\"A breach notification loop-hole for HIPAA covered entities\",\"datePublished\":\"2014-06-04T17:57:37+00:00\",\"dateModified\":\"2020-09-08T18:20:47+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.healthguardsecurity.com\/a-breach-notification-loop-hole-for-hipaa-covered-entities\/\"},\"wordCount\":273,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/www.healthguardsecurity.com\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.healthguardsecurity.com\/a-breach-notification-loop-hole-for-hipaa-covered-entities\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.healthguardsecurity.com\/wp-content\/uploads\/pexels-torsten-dettlaff-193003-scaled.jpg\",\"keywords\":[\"breach\",\"Data Breach\",\"Healthcare\",\"HIPAA\",\"HITECH\",\"hospital\",\"security\"],\"articleSection\":[\"Blog\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.healthguardsecurity.com\/a-breach-notification-loop-hole-for-hipaa-covered-entities\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.healthguardsecurity.com\/a-breach-notification-loop-hole-for-hipaa-covered-entities\/\",\"url\":\"https:\/\/www.healthguardsecurity.com\/a-breach-notification-loop-hole-for-hipaa-covered-entities\/\",\"name\":\"A breach notification loop-hole for HIPAA covered entities | HealthGuard\",\"isPartOf\":{\"@id\":\"https:\/\/www.healthguardsecurity.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.healthguardsecurity.com\/a-breach-notification-loop-hole-for-hipaa-covered-entities\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.healthguardsecurity.com\/a-breach-notification-loop-hole-for-hipaa-covered-entities\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.healthguardsecurity.com\/wp-content\/uploads\/pexels-torsten-dettlaff-193003-scaled.jpg\",\"datePublished\":\"2014-06-04T17:57:37+00:00\",\"dateModified\":\"2020-09-08T18:20:47+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/www.healthguardsecurity.com\/a-breach-notification-loop-hole-for-hipaa-covered-entities\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.healthguardsecurity.com\/a-breach-notification-loop-hole-for-hipaa-covered-entities\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.healthguardsecurity.com\/a-breach-notification-loop-hole-for-hipaa-covered-entities\/#primaryimage\",\"url\":\"https:\/\/www.healthguardsecurity.com\/wp-content\/uploads\/pexels-torsten-dettlaff-193003-scaled.jpg\",\"contentUrl\":\"https:\/\/www.healthguardsecurity.com\/wp-content\/uploads\/pexels-torsten-dettlaff-193003-scaled.jpg\",\"width\":2560,\"height\":1707},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.healthguardsecurity.com\/a-breach-notification-loop-hole-for-hipaa-covered-entities\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.healthguardsecurity.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"A breach notification loop-hole for HIPAA covered entities\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.healthguardsecurity.com\/#website\",\"url\":\"https:\/\/www.healthguardsecurity.com\/\",\"name\":\"HealthGuard\",\"description\":\"HIPAA Security 3.0 for Hospitals\",\"publisher\":{\"@id\":\"https:\/\/www.healthguardsecurity.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.healthguardsecurity.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.healthguardsecurity.com\/#organization\",\"name\":\"HealthGuard\",\"url\":\"https:\/\/www.healthguardsecurity.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.healthguardsecurity.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.healthguardsecurity.com\/wp-content\/uploads\/HG_Logo-Updated.png\",\"contentUrl\":\"https:\/\/www.healthguardsecurity.com\/wp-content\/uploads\/HG_Logo-Updated.png\",\"width\":921,\"height\":250,\"caption\":\"HealthGuard\"},\"image\":{\"@id\":\"https:\/\/www.healthguardsecurity.com\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/x.com\/healthguardsec\",\"https:\/\/www.linkedin.com\/company\/healthguard\/\",\"https:\/\/www.youtube.com\/user\/HealthGuardSec\"],\"description\":\"Risk Management software and services for hospitals.\",\"email\":\"info@healthguardsecurity.com\",\"legalName\":\"CAPC Group, LLC\",\"foundingDate\":\"2001-07-06\",\"numberOfEmployees\":{\"@type\":\"QuantitativeValue\",\"minValue\":\"1\",\"maxValue\":\"10\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.healthguardsecurity.com\/#\/schema\/person\/19e63e3e2ab94d82417a803ec8e06430\",\"name\":\"Apolonio Garcia\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.healthguardsecurity.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/7cce05681385e6479c0c98a8657c8f46?s=96&d=blank&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/7cce05681385e6479c0c98a8657c8f46?s=96&d=blank&r=g\",\"caption\":\"Apolonio Garcia\"},\"sameAs\":[\"http:\/\/www.healthguardsecurity.com\"],\"url\":\"https:\/\/www.healthguardsecurity.com\/author\/agarcia\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"A breach notification loop-hole for HIPAA covered entities | HealthGuard","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.healthguardsecurity.com\/a-breach-notification-loop-hole-for-hipaa-covered-entities\/","og_locale":"en_US","og_type":"article","og_title":"A breach notification loop-hole for HIPAA covered entities","og_description":"According to the National Conference for State Legislatures (NCSL) website, there are currently forty-seven states with breach notification laws.","og_url":"https:\/\/www.healthguardsecurity.com\/a-breach-notification-loop-hole-for-hipaa-covered-entities\/","og_site_name":"HealthGuard","article_published_time":"2014-06-04T17:57:37+00:00","article_modified_time":"2020-09-08T18:20:47+00:00","og_image":[{"width":2560,"height":1707,"url":"https:\/\/www.healthguardsecurity.com\/wp-content\/uploads\/pexels-torsten-dettlaff-193003-scaled.jpg","type":"image\/jpeg"}],"author":"Apolonio Garcia","twitter_card":"summary_large_image","twitter_creator":"@healthguardsec","twitter_site":"@healthguardsec","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.healthguardsecurity.com\/a-breach-notification-loop-hole-for-hipaa-covered-entities\/#article","isPartOf":{"@id":"https:\/\/www.healthguardsecurity.com\/a-breach-notification-loop-hole-for-hipaa-covered-entities\/"},"author":{"name":"Apolonio Garcia","@id":"https:\/\/www.healthguardsecurity.com\/#\/schema\/person\/19e63e3e2ab94d82417a803ec8e06430"},"headline":"A breach notification loop-hole for HIPAA covered entities","datePublished":"2014-06-04T17:57:37+00:00","dateModified":"2020-09-08T18:20:47+00:00","mainEntityOfPage":{"@id":"https:\/\/www.healthguardsecurity.com\/a-breach-notification-loop-hole-for-hipaa-covered-entities\/"},"wordCount":273,"commentCount":0,"publisher":{"@id":"https:\/\/www.healthguardsecurity.com\/#organization"},"image":{"@id":"https:\/\/www.healthguardsecurity.com\/a-breach-notification-loop-hole-for-hipaa-covered-entities\/#primaryimage"},"thumbnailUrl":"https:\/\/www.healthguardsecurity.com\/wp-content\/uploads\/pexels-torsten-dettlaff-193003-scaled.jpg","keywords":["breach","Data Breach","Healthcare","HIPAA","HITECH","hospital","security"],"articleSection":["Blog"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.healthguardsecurity.com\/a-breach-notification-loop-hole-for-hipaa-covered-entities\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.healthguardsecurity.com\/a-breach-notification-loop-hole-for-hipaa-covered-entities\/","url":"https:\/\/www.healthguardsecurity.com\/a-breach-notification-loop-hole-for-hipaa-covered-entities\/","name":"A breach notification loop-hole for HIPAA covered entities | HealthGuard","isPartOf":{"@id":"https:\/\/www.healthguardsecurity.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.healthguardsecurity.com\/a-breach-notification-loop-hole-for-hipaa-covered-entities\/#primaryimage"},"image":{"@id":"https:\/\/www.healthguardsecurity.com\/a-breach-notification-loop-hole-for-hipaa-covered-entities\/#primaryimage"},"thumbnailUrl":"https:\/\/www.healthguardsecurity.com\/wp-content\/uploads\/pexels-torsten-dettlaff-193003-scaled.jpg","datePublished":"2014-06-04T17:57:37+00:00","dateModified":"2020-09-08T18:20:47+00:00","breadcrumb":{"@id":"https:\/\/www.healthguardsecurity.com\/a-breach-notification-loop-hole-for-hipaa-covered-entities\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.healthguardsecurity.com\/a-breach-notification-loop-hole-for-hipaa-covered-entities\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.healthguardsecurity.com\/a-breach-notification-loop-hole-for-hipaa-covered-entities\/#primaryimage","url":"https:\/\/www.healthguardsecurity.com\/wp-content\/uploads\/pexels-torsten-dettlaff-193003-scaled.jpg","contentUrl":"https:\/\/www.healthguardsecurity.com\/wp-content\/uploads\/pexels-torsten-dettlaff-193003-scaled.jpg","width":2560,"height":1707},{"@type":"BreadcrumbList","@id":"https:\/\/www.healthguardsecurity.com\/a-breach-notification-loop-hole-for-hipaa-covered-entities\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.healthguardsecurity.com\/"},{"@type":"ListItem","position":2,"name":"A breach notification loop-hole for HIPAA covered entities"}]},{"@type":"WebSite","@id":"https:\/\/www.healthguardsecurity.com\/#website","url":"https:\/\/www.healthguardsecurity.com\/","name":"HealthGuard","description":"HIPAA Security 3.0 for Hospitals","publisher":{"@id":"https:\/\/www.healthguardsecurity.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.healthguardsecurity.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.healthguardsecurity.com\/#organization","name":"HealthGuard","url":"https:\/\/www.healthguardsecurity.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.healthguardsecurity.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.healthguardsecurity.com\/wp-content\/uploads\/HG_Logo-Updated.png","contentUrl":"https:\/\/www.healthguardsecurity.com\/wp-content\/uploads\/HG_Logo-Updated.png","width":921,"height":250,"caption":"HealthGuard"},"image":{"@id":"https:\/\/www.healthguardsecurity.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/healthguardsec","https:\/\/www.linkedin.com\/company\/healthguard\/","https:\/\/www.youtube.com\/user\/HealthGuardSec"],"description":"Risk Management software and services for hospitals.","email":"info@healthguardsecurity.com","legalName":"CAPC Group, LLC","foundingDate":"2001-07-06","numberOfEmployees":{"@type":"QuantitativeValue","minValue":"1","maxValue":"10"}},{"@type":"Person","@id":"https:\/\/www.healthguardsecurity.com\/#\/schema\/person\/19e63e3e2ab94d82417a803ec8e06430","name":"Apolonio Garcia","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.healthguardsecurity.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/7cce05681385e6479c0c98a8657c8f46?s=96&d=blank&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/7cce05681385e6479c0c98a8657c8f46?s=96&d=blank&r=g","caption":"Apolonio Garcia"},"sameAs":["http:\/\/www.healthguardsecurity.com"],"url":"https:\/\/www.healthguardsecurity.com\/author\/agarcia\/"}]}},"_links":{"self":[{"href":"https:\/\/www.healthguardsecurity.com\/wp-json\/wp\/v2\/posts\/2631"}],"collection":[{"href":"https:\/\/www.healthguardsecurity.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.healthguardsecurity.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.healthguardsecurity.com\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.healthguardsecurity.com\/wp-json\/wp\/v2\/comments?post=2631"}],"version-history":[{"count":0,"href":"https:\/\/www.healthguardsecurity.com\/wp-json\/wp\/v2\/posts\/2631\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.healthguardsecurity.com\/wp-json\/wp\/v2\/media\/8075"}],"wp:attachment":[{"href":"https:\/\/www.healthguardsecurity.com\/wp-json\/wp\/v2\/media?parent=2631"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.healthguardsecurity.com\/wp-json\/wp\/v2\/categories?post=2631"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.healthguardsecurity.com\/wp-json\/wp\/v2\/tags?post=2631"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}