Assess a suspected breach of unsecured protected health information
Key facts
- Human involvement
- YellowClose supervision
- How AI is used
- Extract the date of discovery, whose information is involved, whether it was encrypted or destroyed, and whether a business associate or the covered entity holds it. Do not decide that notification is required and do not draft the notice.
- What the lawyer must review
- HHS states that 45 CFR §§ 164.400-414 require covered entities and business associates to notify after a breach of unsecured protected health information. Unsecured means the information has not been rendered unusable, unreadable or indecipherable by the encryption or destruction methods in the HHS guidance. Individual notice must be without unreasonable delay and no later than 60 days after discovery. A breach affecting more than 500 residents of a state or jurisdiction also requires media notice. The Secretary is notified as well. A business associate notifies the covered entity. You decide whether there is a breach and whether an exception applies. You write any notice.
- Written for / version
- United States versionUS
Who does what
| Role | What they do |
|---|---|
| Assistance | Potential support includes extracting and organising information and preparing preliminary structure or wording. Confirm the tool’s capability and permitted scope. |
| Lawyer | Set the scope, supervise the work closely, verify every part relied on, resolve omissions and exceptions, and approve the exact output. |
Checklist
- Verify the applicable jurisdiction and the version of each relevant law, rule or instrument in force at the material time.
- Confirm the output against the client’s instructions and the complete relevant source material, including omissions or contradictions.
- Resolve exceptions and record the responsible lawyer’s approval of the exact output and intended use.
Forms and precedents for this task
| Form or precedent | Kind | AI use | Summary |
|---|---|---|---|
| HIPAA use and disclosure limits checklist | Checklist | AI use Yellow | Checklist of the use and disclosure limits in 45 CFR 164.502 that a reviewer applies to a business associate contract and a privacy notice. |
Signed-in accounts can read the full text of each one. All precedents.