- Conducting HIPAA Breach Risk Assessments Using the “LoProCo” Analysis
- December 4, 2013 | Authors: Margaret Young Levi; Kathie McDonald-McClure
- Law Firms: Wyatt, Tarrant & Combs, LLP - Lexington Office ; Wyatt, Tarrant & Combs, LLP - Louisville Office
The U.S. Department of Health & Human Services Office for Civil Rights (“OCR”) has a new acronym, “LoProCo,” relating to assessing data breaches under HIPAA, as amended by the Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009 and the HIPAA Omnibus Rule that became effective March 26, 2013.
It is OCR’s position that a breach is presumed-unless an entity can demonstrate that there is a Low Probability that the data has been Compromised (LoProCo). With any breach, entities should immediately perform a risk assessment and look at certain factors to decide whether there is a low probability of compromise or LoProCo. The risk assessment should consider:
1. The nature and extent of the protected health information (PHI) involved (including the types of individual identifiers and the likelihood of re-identification);
2. Who was the unauthorized person who received or accessed the PHI;
3. Whether the PHI was actually acquired or viewed; and
4. The extent to which the risk to the PHI has been mitigated.
Take, for example, a breach involving a misdirected fax, which is one of the most frequent small breaches reported to OCR. In performing this analysis, entities should consider who received the fax. Was the fax sent to the wrong physician’s office? Or perhaps to a bank? In either case, it is expected the data would not be compromised because both those entities have confidentiality requirements. However, if the fax is sent to a local convenience store then there is more risk. Also consider how quickly the recipient was contacted about the fax? Was there time for the fax to be reviewed or copied? Was the fax destroyed?
If a thorough LoProCo analysis does not lead to a conclusion that there was a low probability that the PHI was compromised, then breach notification is required.