Business Associate Breach Response Guide for Bone and Joint Infection Clinics

What counts as a breach of unsecured PHI in a bone and joint infection clinic?

A breach generally involves the impermissible acquisition, access, use, or disclosure of protected health information (PHI) that compromises its privacy or security. Examples at a bone and joint infection clinic could include a vendor exposing patient records containing identifying details alongside infection diagnoses, culture results, imaging, or treatment information; a misdirected report; or unauthorized access to a clinic system.

The HIPAA Breach Notification Rule applies to breaches of unsecured protected health information—PHI that has not been rendered unusable, unreadable, or indecipherable to unauthorized people using a method specified by HHS. HHS recognizes qualifying encryption and destruction methods; encryption may not protect the data for this purpose if the decryption key is also compromised. See HHS’s Breach Notification Rule and HHS guidance on securing PHI.

An impermissible use or disclosure is presumed to be a breach unless the clinic or business associate documents a low probability that the PHI was compromised based on a risk assessment. The assessment must consider the nature and extent of the PHI, who received or used it, whether it was actually acquired or viewed, and how effectively the risk was mitigated. HIPAA also identifies limited exceptions, including certain good-faith, in-scope access by a workforce member. Document the facts and the rationale for any decision that notification is not required.

When does the business associate breach notification clock start?

For the business associate, the breach discovery date is the first day the breach is known—or would have been known through reasonable diligence—to the business associate. Knowledge by an employee, officer, or other agent generally counts, except for the person who committed the breach. The clock does not necessarily wait until the investigation is complete or the full number of affected patients is confirmed.

The business associate must notify the clinic without unreasonable delay and no later than 60 calendar days after discovery. That is an outer limit, not a target to wait for. The business associate agreement (BAA) may set a shorter reporting deadline or require notice of suspected incidents, so check the contract and follow the stricter applicable timeline. HIPAA’s business associate timing and discovery rules are summarized in HHS breach notification guidance.

What information must the business associate provide to the clinic?

The business associate must identify each affected individual to the extent possible and provide the information the clinic needs for its required notices, either with the initial notification or promptly as it becomes available. The BAA may require a specific format, contact channel, or faster schedule; use those terms to organize the response.

Ask the business associate to provide, as available:

• A clear description of what happened, when the incident and discovery occurred, and how it was detected.
• The identities of affected or potentially affected individuals, with useful contact information and a description of how each person’s records may have been involved.
• The types of PHI involved—for example, identifying information, infection diagnosis, laboratory or culture results, imaging, treatment details, or billing information.
• The systems, locations, and business associate or subcontractor personnel involved, along with relevant access, disclosure, and containment facts.
• What has been done to stop or contain the incident, recover or secure information, investigate, and reduce potential harm, plus planned corrective actions.

These details help the clinic assess notification duties and prepare accurate communications. HHS describes the information a business associate must provide in its Breach Notification Rule guidance.

How should the clinic coordinate patient notification and authority reporting?

For a breach at or by a business associate, the covered clinic remains responsible for ensuring affected individuals are notified, though it may delegate delivery to the business associate. Decide early who will draft, approve, send, and respond to notices; confirm this plan against the BAA and applicable law. Coordinate one consistent account of the incident, and provide additional information as the investigation develops.

For HIPAA reporting, a covered clinic generally notifies the HHS Secretary through the Office for Civil Rights (OCR). A breach affecting 500 or more individuals must be reported without unreasonable delay and no later than 60 calendar days after discovery. A breach affecting fewer than 500 individuals must be logged and reported no later than 60 days after the end of the calendar year in which it was discovered. A business associate may submit the OCR report on the clinic’s behalf, but the clinic should expressly assign and verify that task. See HHS OCR’s breach reporting instructions.

If a breach affects more than 500 residents of a state or jurisdiction, the clinic must also notify prominent media outlets serving that area. Separately assess state breach-notification laws and other applicable reporting obligations; requirements can differ by location and may apply in addition to HIPAA. HHS explains the HIPAA media and individual notice rules in its Breach Notification Rule overview and discusses more stringent state privacy protections in its state-law guidance.

What should a patient breach notice include?

Write in plain language and include, to the extent possible:

• A brief description of what happened, including the breach date and the breach discovery date if known.
• The types of unsecured PHI involved, without unnecessarily exposing additional sensitive information.
• Practical steps patients can take to protect themselves from potential harm.
• A brief explanation of what the clinic is doing to investigate, mitigate harm, and prevent further breaches.
• Contact procedures for questions or further information, such as a toll-free phone number, email address, website, or postal address.

Send individual notices without unreasonable delay and no later than 60 calendar days after the clinic’s discovery of the breach, subject to any applicable law requiring earlier notice. HIPAA generally requires written notice by first-class mail, or email if the individual agreed to receive notices electronically. If contact information is insufficient or out of date for 10 or more individuals, HIPAA requires substitute notice using the specified website or media method and a toll-free number active for at least 90 days; different substitute-notice options apply when fewer than 10 people lack usable contact information. See HHS’s individual notification requirements.

How should breach notifications and response decisions be documented?

Maintain a dated incident file that supports both the response and the clinic’s compliance decisions. Include the incident timeline, how and when the clinic and business associate learned of the event, discovery-date analysis, affected-person counts, PHI categories, investigation records, containment steps, and communications between the parties.

For the breach risk assessment documentation, record each required factor: the nature and extent of the PHI, the unauthorized recipient or user, whether the information was actually acquired or viewed, and mitigation. If the clinic concludes an exception applies or that there is a low probability the PHI was compromised, retain the supporting facts and reasoning. If notice is required, keep copies of notices, recipient lists, mailing or delivery records, contact-center procedures, OCR and media submissions when applicable, and evidence of when each action occurred.

Also preserve the relevant business associate agreement (BAA), decision approvals, corrective actions, and any supplemental information received after initial notification. HHS says covered entities and business associates must be able to demonstrate that required notifications were made or that notification was not required; its Breach Notification Rule guidance describes this documentation burden.

In summary: assess whether unsecured PHI was involved, establish and track discovery dates, obtain the facts the clinic needs from its business associate, and coordinate patient, OCR, and any applicable media or state-law notices. Keep a clear record of the investigation, decisions, and actions taken.

FAQs

How quickly must a business associate notify a bone and joint infection clinic of a breach?

The business associate must notify the clinic without unreasonable delay and no later than 60 calendar days after discovery. The BAA may require a shorter deadline, and prompt notice helps the clinic meet its own obligations. See HHS’s business associate notification guidance.

What information should the business associate include in its notification?

To the extent possible, it should identify affected individuals and provide the information the clinic needs for its notices: what happened, relevant dates, the types of PHI involved, and available investigation and mitigation details. It must provide additional required information promptly as it becomes available. See HHS’s Breach Notification Rule overview.

Who is responsible for notifying affected patients?

The covered clinic is ultimately responsible for ensuring affected individuals receive notice. The clinic may delegate notice delivery to its business associate, but should document that assignment and monitor completion. See HHS’s individual notification guidance.

When must a breach affecting fewer than 500 individuals be reported to federal authorities?

The covered clinic must report it to the HHS Secretary through OCR no later than 60 days after the end of the calendar year in which the breach was discovered. A business associate may submit the report on the clinic’s behalf. See HHS OCR’s breach reporting instructions.