GDPR and HIPAA Incident Reporting

Both GDPR and HIPAA impose mandatory breach notification requirements on organizations that process personal data (GDPR) or protected health information (HIPAA). While the underlying goal is to protect individuals' privacy, the specific rules differ significantly. The CS0-003 exam tests your ability to apply these rules in real-world scenarios, often asking which regulation applies based on data type and geography, and what the notification timeline is.

The GDPR, effective May 25, 2018, applies to any organization processing personal data of individuals in the European Union (EU), regardless of where the organization is based. Key definitions: - Personal data: Any information relating to an identified or identifiable natural person (data subject). This includes names, email addresses, IP addresses, health data, etc. - Personal data breach: A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data transmitted, stored, or otherwise processed.

Notification to Supervisory Authority (SA): - Timeline: Must be notified *without undue delay* and, where feasible, not later than 72 hours after becoming aware of the breach. If not feasible, a reasoned justification must be provided. - Content of notification: Must include:

- Nature of the breach (categories and approximate number of data subjects and records concerned) - Name and contact details of the Data Protection Officer (DPO) or other contact point - Likely consequences of the breach - Measures taken or proposed to address the breach and mitigate its effects - Exceptions: If the breach is unlikely to result in a risk to the rights and freedoms of natural persons, notification is not required. However, the breach must still be documented internally.

Notification to Data Subjects: - When required: When the breach is likely to result in a high risk to the rights and freedoms of natural persons. - Timeline: Must be communicated *without undue delay*. - Content: Similar to SA notification but must be in clear and plain language. - Exceptions: If data were encrypted (and key not compromised), or if subsequent measures have rendered the high risk unlikely to materialize.

Documentation: The controller must document all breaches, including facts, effects, and remedial actions taken, to enable the SA to verify compliance.

The HIPAA Breach Notification Rule, effective September 23, 2009, applies to covered entities (health plans, healthcare clearinghouses, healthcare providers) and their business associates. Key definitions: - Protected Health Information (PHI): Individually identifiable health information held or transmitted by a covered entity or its business associate, in any form (electronic, paper, oral). - Breach: The acquisition, access, use, or disclosure of PHI in a manner not permitted under the Privacy Rule that compromises the security or privacy of the PHI. - Exception: There is a low probability that PHI has been compromised based on a risk assessment considering: 1. The nature and extent of the PHI involved 2. The unauthorized person who used the PHI or to whom the disclosure was made 3. Whether the PHI was actually acquired or viewed 4. The extent to which the risk to the PHI has been mitigated

Notification to Affected Individuals: - Timeline: Must be notified without unreasonable delay and in no case later than 60 calendar days from discovery of the breach. - Content: Must include:

- Brief description of the breach - Types of PHI involved - Steps individuals should take to protect themselves - Brief description of what the covered entity is doing to investigate, mitigate, and prevent future breaches - Contact information for the covered entity - Method: Written notice by first-class mail, or email if agreed to. If insufficient contact information, substitute notice via web posting or print/broadcast media.

Notification to Secretary of HHS: - For breaches affecting 500+ individuals: Must be notified without unreasonable delay and in no case later than 60 calendar days from discovery. - For breaches affecting fewer than 500 individuals: Must be logged and reported to the Secretary annually within 60 days of the end of the calendar year.

Notification to Media: - For breaches affecting 500+ individuals: Must notify prominent media outlets serving the state or jurisdiction without unreasonable delay and within 60 calendar days.

Business Associate Obligations: Business associates must notify the covered entity of a breach within 60 calendar days of discovery.

| Aspect | GDPR | HIPAA | |--------|------|-------| | Trigger | Personal data breach (any type) | Breach of PHI (health data) | | Risk threshold | High risk to rights and freedoms triggers data subject notification | Low probability of compromise determines if breach occurred | | Timeline for authority | 72 hours | 60 days (for 500+ individuals) | | Timeline for individual | Without undue delay | 60 days | | Documentation | Must document all breaches | Must document breaches affecting <500 individuals annually | | Penalties | Up to 4% of annual global turnover or €20 million (whichever greater) | Up to $1.5 million per violation per year (tiered based on culpability) |

Both regulations require that breach notification be part of the incident response plan. Key steps: - Detection: Identify that a breach has occurred. - Assessment: Determine the type of data involved and the number of affected individuals. - Risk evaluation: For GDPR, assess risk to rights and freedoms; for HIPAA, assess probability of compromise. - Notification: Prepare and send notifications within required timelines. - Documentation: Record all actions taken.

A global healthcare provider with operations in the EU and US experiences a ransomware attack that encrypts patient records. The incident response team must determine which regulations apply: GDPR for EU patients, HIPAA for US patients. The team works in parallel: for EU patients, they notify the relevant supervisory authority within 72 hours and assess high risk to data subjects (e.g., if records included financial info). For US patients, they perform a four-factor risk assessment; because the data was encrypted and the key was not compromised, they determine low probability of compromise and decide not to notify individuals, but log the breach. They notify HHS within 60 days because fewer than 500 US patients were affected. The organization also faces potential fines from both regulators if timelines are missed.

A US-based cloud service provider stores personal data of EU residents. A misconfigured S3 bucket exposes names, email addresses, and hashed passwords. The provider becomes aware on day 1. Under GDPR, they must notify the supervisory authority by day 4 (72 hours). They also assess high risk because passwords could be cracked, so they notify data subjects via email. They document the breach and implement additional access controls. Since they are not a covered entity under HIPAA (no PHI), only GDPR applies. Common mistake: assuming US companies are only subject to US laws—GDPR has extraterritorial reach.

A small dental clinic loses a laptop containing unencrypted PHI of 200 patients. The clinic discovers the loss on Monday. Under HIPAA, they must notify affected individuals within 60 days (by the following Monday + 60 days). They must also notify HHS within 60 days because fewer than 500 individuals are affected (annual report due by end of year). They perform a risk assessment: the laptop was password-protected but not encrypted, so there is not a low probability of compromise. They send written notices via first-class mail. Common pitfall: assuming that because the laptop was password-protected, it is not a breach—HIPAA requires encryption or equivalent safeguard to avoid notification.