Guilty until proven innocent

One of the major changes the final omnibus rule places on providers and business associates is the presumption that any unauthorized use or disclosure of unsecured protected health information (PHI) is a "breach." Specifically, the omnibus rule states that:

"… an acquisition, access, use, or disclosure of protected health information in a manner not permitted [under the Privacy Rule] ... is presumed to be a breach unless the covered entity or business associate, as applicable, demonstrates that there is a low probability that the protected health information has been compromised based on a risk assessment."

This is an excerpt from members-only content. Please log in or become a member to access the full content.