hipaa
Insurance Company sending possible PHI to the wrong mailing address
<p>I'm wondering if sending snail mail to the wrong address could ever be a violation of HIPAA?  Obviously, due to people moving and not updating their account information, this likely happens all the time</p>

<p>However, what if an insurance member has requested an address change from the insurance company (multiple times) but the company fails to update their address in the system and continues to send documents (Explanations of Benefits) to the wrong address?</p>

<p>Under <a href="https://www.ecfr.gov/cgi-bin/text-idx?SID=0ed84c7423abdfca1fa81d772667435a&amp;mc=true&amp;node=sp45.1.164.d&amp;rgn=div6" rel="nofollow noreferrer">45 CFR 164.402</a> a "breach" is </p>

<blockquote>
  <p>the acquisition, access, use, or disclosure of protected health
  information in a manner not permitted under subpart E of this part
  which compromises the security or privacy of the protected health
  information.</p>
</blockquote>

<p>Disclosing PHI to random people is not permitted under subpart E. Then then allow that it can be deemed to not be a breach if they can "demonstrate[] that there is a low probability that the protected health information has been compromised based on a risk assessment of certain factors – there isn't any clear yes/no rule as to how you could say that disclosing PHI is <em>not</em> a breach.</p>

<p>If they discover a breach, they must notify the affected individual. One ploy would be for them to stick their heads in the sand and be careful to not discover: but §164.404(2) says</p>

<blockquote>
  <p>A covered entity shall be deemed to have knowledge of a breach if such
  breach is known, or <em>by exercising reasonable diligence would have been
  known</em>, to any person, other than the person committing the breach, who
  is a workforce member or agent of the covered entity</p>
</blockquote>

<p>So if, for example, they had been told that person X has moved, a reasonably diligent person would know that sending PHI to the old address will result in a breach. The Sec'y of HHS must also be notified of the breach, though this can go in the annual report if the breach involves fewer than 500 people. The affected individual can also <a href="https://www.hhs.gov/hipaa/filing-a-complaint/complaint-process/index.html" rel="nofollow noreferrer">file a complaint</a> with HHS.</p>
