Business Associate Breach Response Guide for Physician-Owned Surgical Hospitals

When a physician-owned surgical hospital acts as a HIPAA covered entity, a business associate’s breach can trigger urgent investigation and notification duties. The hospital’s ownership structure does not replace the need to determine its HIPAA role, follow its business associate agreements (BAAs), and apply the HIPAA Breach Notification Rule to breaches of unsecured protected health information (PHI).

This guide explains the business associate’s response, the hospital’s breach risk assessment, and the notice deadlines. It addresses federal HIPAA requirements; state law, contracts, and other applicable rules may impose additional obligations.

What should a business associate do after discovering a breach?

The business associate should promptly contain the incident, protect systems and records, preserve relevant evidence, and notify the hospital through the contacts and process specified in the BAA. The BAA may require reporting a suspected incident or impermissible use or disclosure of PHI before the facts establish that it is a reportable breach, and may set a shorter deadline than HIPAA’s outside limit.

For a breach of unsecured PHI, the business associate must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery. Discovery generally begins when the breach is known, or would have been known through reasonable diligence, to the business associate or one of its workforce members or agents other than the person committing the breach. Do not wait for the investigation to be complete before escalating the event. See 45 CFR § 164.410 and HHS guidance on the Breach Notification Rule.

At the same time, the business associate should stop ongoing unauthorized access or disclosure where possible, secure affected accounts and devices, assess whether PHI was acquired or viewed, and coordinate with the hospital on investigation and mitigation. Report the facts known so far, identify uncertainties, and provide updates as new information becomes available.

How should the covered entity assess whether an incident is a reportable breach?

First determine whether the event involved PHI and whether that information was unsecured. PHI properly encrypted under applicable HHS guidance, with the decryption key or process not compromised, may fall outside the breach-notification requirement; confirm that the encryption and key protections meet the applicable standard before relying on this exception. See HHS guidance on rendering PHI unusable, unreadable, or indecipherable.

An impermissible use or disclosure of PHI is generally presumed to be a breach unless an exception applies or the covered entity or business associate demonstrates, through a documented breach risk assessment, a low probability that the PHI was compromised. The assessment should address at least:

• The nature and extent of the PHI, including identifiers and the likelihood of re-identification.
• Who used the PHI or received the disclosure, and whether that person had an obligation to protect it.
• Whether the PHI was actually acquired or viewed.
• The extent to which the risk was mitigated, such as whether the recipient returned or securely destroyed the information.

The rule also defines limited exceptions, including certain unintentional good-faith workforce actions within job authority, certain inadvertent disclosures between people authorized to access PHI, and disclosures to a person who could not reasonably retain the information. Evaluate the facts against the rule rather than assuming every security incident is a reportable breach—or that an incident is not reportable because there is no confirmed evidence of misuse. See HHS’s breach definition and risk-assessment guidance and 45 CFR § 164.402.

What information must the business associate provide to the hospital?

The business associate must identify each affected individual to the extent possible and provide other available information the hospital needs for its individual notices. It may send initial information with the first covered entity notification and provide additional details promptly as they become available. The BAA may also require a specific reporting format, contact method, or more detailed incident report. See 45 CFR § 164.410(c).

A useful initial report should include, when known:

• When the incident occurred, when it was discovered, and how discovery occurred.
• The systems, records, and PHI involved, including the types of information and an estimated number of affected individuals.
• The identities or categories of people who accessed or received the information, and whether it was acquired, viewed, copied, or further disclosed.
• Containment steps, mitigation actions, investigation status, and any remaining risk.
• A reliable business associate contact for follow-up and a schedule for providing updates.

If the affected-person count or data elements are not yet known, state what remains uncertain, explain how the business associate is investigating, and update the hospital promptly. Avoid sending unnecessary PHI in the incident report; use the secure communication method agreed with the hospital.

Who is responsible for notifying affected individuals and regulators?

The covered entity is generally responsible for notifying affected individuals, the HHS Secretary, and, when the threshold is met, prominent media outlets. A business associate’s primary HIPAA breach-notification duty is to notify the covered entity. A BAA may assign the business associate tasks such as preparing or sending notices or submitting an HHS report on the covered entity’s behalf, but the parties should document who will perform each task and confirm that the required notices are completed. See HHS’s overview of covered entity and business associate responsibilities.

The hospital should coordinate with its privacy, security, legal, communications, and clinical leaders as appropriate. If the business associate is handling a notice under the BAA, the hospital should review the affected-person count, notice content, delivery method, and timing rather than assuming the assignment transfers away its covered entity obligations.

What are the HIPAA breach notification deadlines and reporting thresholds?

For a breach of unsecured PHI, individual notice must be sent without unreasonable delay and no later than 60 calendar days after discovery. The covered entity must also notify HHS. For a breach involving 500 or more individuals, report to HHS without unreasonable delay and no later than 60 calendar days after discovery. For a breach involving fewer than 500 individuals, the covered entity may report to HHS annually, no later than 60 days after the end of the calendar year in which the breach was discovered. See 45 CFR § 164.404, 45 CFR § 164.408, and HHS instructions for breach reporting.

A separate threshold applies to a prominent media notice: the covered entity must notify prominent media outlets serving the state or jurisdiction if a breach involves more than 500 residents of that state or jurisdiction. This media threshold is based on the number of residents in the affected state or jurisdiction, while the HHS reporting threshold is 500 or more affected individuals. Required notices generally must be provided without unreasonable delay and no later than 60 calendar days after discovery. See 45 CFR § 164.406.

These are federal outer deadlines, not a recommended waiting period. The hospital and business associate should begin investigating and preparing notices promptly, while checking the BAA, applicable state breach-notification laws, and any law-enforcement delay permitted by HIPAA.

What should individual breach notices include?

Notices should be written in plain language and, to the extent possible, explain what happened, including the breach and discovery dates if known; the types of unsecured PHI involved; steps individuals can take to protect themselves; what the hospital is doing to investigate, mitigate harm, and prevent further breaches; and how individuals can ask questions or obtain additional information. See 45 CFR § 164.404(c).

The covered entity generally sends written notice by first-class mail to the individual’s last known address, or by email if the individual has agreed to electronic notice. If contact information is insufficient for 10 or more individuals, substitute notice must use a permitted method, such as a conspicuous website posting or major print or broadcast media notice, and include a toll-free number active for at least 90 days. For fewer than 10 individuals with insufficient contact information, the rule permits alternative notice methods. The notice must still meet the required content and timing rules.

How should breach response decisions and notifications be documented?

Keep a response file that lets the hospital show what happened, how it assessed the incident, and why it notified—or did not notify—individuals and regulators. Include the incident timeline; discovery date and source; affected systems and PHI; investigation evidence; the breach risk assessment and its four factors; any exception relied upon; mitigation steps; the affected-person count and how it was calculated; and the rationale for each decision.

Retain copies of the BAA and relevant policies, communications between the hospital and business associate, notice drafts and final versions, mailing or delivery records, HHS submissions, media notices when required, and records of any delay and its legal basis. HIPAA places the burden on the covered entity or business associate, as applicable, to demonstrate that required notifications were made or that the event did not constitute a breach. Required HIPAA documentation is generally retained for six years from its creation or the date it was last in effect, whichever is later; check other applicable retention requirements as well. See 45 CFR § 164.414 and 45 CFR § 164.530(j).

In short, report promptly, assess the facts against the HIPAA breach standard, coordinate responsibilities under the BAA, meet each applicable notice deadline, and preserve the evidence and decisions supporting the response.

FAQs

How soon must a business associate notify a covered entity of a breach?

The business associate must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovering a breach of unsecured PHI. The BAA may require faster reporting, and it may require reporting suspected incidents before the investigation confirms a breach.

When must affected individuals receive breach notification?

The covered entity must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovering a breach of unsecured PHI. A business associate may prepare or send notices if the BAA assigns it that task, but the covered entity should ensure notices are completed on time.

Which breaches require notice to prominent media outlets?

A covered entity must notify prominent media outlets serving a state or jurisdiction when a breach involves more than 500 residents of that state or jurisdiction. The notice is due without unreasonable delay and no later than 60 calendar days after discovery.

What records should a surgical hospital keep to document breach response?

Keep the incident timeline, investigation evidence, breach risk assessment, affected-person count, notification decisions, mitigation records, copies of notices and HHS reports, delivery evidence, and communications with the business associate. Also retain records supporting a decision that notice was not required and document any delay. HIPAA-required documentation is generally retained for six years from creation or the date it was last in effect, whichever is later.