Practice burglary is not an automatic HIPAA breach; look for breach evidence

Article Overview

This article discusses how a health care practice should evaluate whether a burglary involving potential protected health information exposure rises to the level of a reportable HIPAA security incident. It is aimed at compliance staff, privacy and security officers, practice managers, and others responsible for HIPAA incident response, documentation, and breach assessment. The guidance covers asset inventory, evidence gathering, access-log review, internal reporting, committee documentation, and the general process for determining whether breach-notification steps may be needed.