Although small privacy breaches affecting less than 500 patients per incident are not usually broadcast as widely as large scale cyberattacks, they can be just as detrimental to healthcare organizations. These small breaches can be as simple as a patient’s protected health information (PHI) mistakenly going to the wrong person.
The financial impact of small breaches is real. According to the American National Standards Institute, each breach can cost anywhere from $8,000 to $300,000, not including HIPAA violation civil penalties, which can be as much as $50,000 per breach, with a maximum of $1.5 million annually for repeated occurrences. But it is not just the monetary aspect that makes breaches so costly; the loss of brand value is a major threat as well.
Since 2009, more than 180,000 small breaches have been reported to the U.S. Department of Health and Human Services’ (HHS) Office for Civil Rights (OCR), compared with just 1,700 breaches involving more than 500 patients. While large scale breaches caused by hacking pose an obvious threat, smaller breaches are not to be taken lightly.
In fact, there is a heightened awareness of small breaches across the healthcare industry. The OCR launched a new initiative in August 2016 aimed at increasing the investigative and enforcement authority of its regional offices. This initiative allows regional offices to prioritize which breaches to investigate and how to allocate resources based on the size of the breach, the theft or improper disposal of unencrypted PHI, the amount, nature and sensitivity of the PHI involved, and other considerations.
According to the OCR, this initiative will help “more widely investigate the root causes of breaches affecting fewer than 500 individuals.” Regional offices will look for patterns and series of breaches in order to quell their increasing frequency.
The Risky Business of Release of Information
MRO’s research shows there are as many as 40 disclosure points across individual health systems. Most of these disclosure points tend to be managed outside the health Information management (HIM) department by individuals not trained in release of information (ROI) and PHI disclosure management. This trend of expanding disclosure points is one of the key factors driving breach risk in the ROI process.
Another key factor driving risk involves gaps in the quality assurance (QA) processes. Research shows that approximately 30 percent of all ROI authorizations are initially invalid, and up to 10 percent of these invalid authorizations are processed with errors if ROI workflows lack redundant QA checks. Moreover, some five percent of patient data in electronic medical records (EMRs) have integrity issues, including comingled patient records. Without proper QA measures in place, 0.7 percent of records released will contain mixed patient data, which means an organization releasing 100,000 requests annually could potentially release 700 comingled records.
The increasingly complex regulations and compliance requirements for sharing PHI constitute another factor in the growing number of small breaches caused by improper disclosure. According to a 2015 Ponemon Institute survey, 40 percent of breaches are caused by unintentional employee actions, which lead to improper disclosures.
Filling the Gaps in ROI Workflow to Minimize Breach Risk
Deploying an enterprise-wide strategy for PHI disclosure management standardizes policies and procedures, as well as technologies, across a health system. Having a streamlined ROI workflow as part of that strategy helps eliminate inefficiencies, distractions and errors.
Additionally, redundant QA checks are vital for disclosure accuracy. Providing a “second set of eyes” on all authorizations and PHI before release will help reduce improper disclosures. These additional quality checks should come from a combination of trained ROI specialists and record integrity technology that uses optical character recognition to locate and correct comingled records. This combination of people and technology will drive improved accuracy and minimize breach risk.
ensure that their current policies and procedures align with the law.
Given the vast quantity of information published by the federal government, Medicare Administrative Contractors (MACs), consultants, and others, it can be easy to lose track
Recent updates to the Health Insurance Portability and Accountability Act (HIPAA) represent the most significant shift in healthcare privacy and security requirements in over a
Please log in to your account to comment on this article.
Uncover essential coding insights with nationally recognized coding authority Kay Piper, RHIA, CDIP, CCS. Through ICD10monitor’s interactive, on‑demand webcast series, Kay walks you through the AHA’s 2026 ICD‑10‑CM/PCS Quarterly Coding Clinics, translating each update into practical, easy‑to‑apply guidance designed to sharpen precision, ensure compliance, and strengthen day‑to‑day decision‑making. Available shortly after each official release.
Uncover critical guidance on the ICD-10-CM/PCS code updates. Kay Piper reviews and explains ICD-10-CM/PCS coding guidelines in the AHA’s fourth quarter 2026 ICD-10-CM/PCS Coding Clinic in an easy to access on-demand webcast.
Uncover critical guidance on the ICD-10-CM/PCS code updates. Kay Piper reviews and explains ICD-10-CM/PCS coding guidelines in the AHA’s third quarter 2026 ICD-10-CM/PCS Coding Clinic in an easy to access on-demand webcast.
Uncover critical guidance on the ICD-10-CM/PCS code updates. Kay Piper reviews and explains ICD-10-CM/PCS coding guidelines in the AHA’s second quarter 2026 ICD-10-CM/PCS Coding Clinic in an easy to access on-demand webcast.
Federal auditors are intensifying their focus on inpatient psychiatric facilities, using advanced data analytics to spotlight outliers and pursue high‑dollar repayments. In this high‑impact webcast, Michael Calahan, PA, MBA, Compliance Officer and V.P., Hospital & Physician Compliance, breaks down what regulators are really targeting in IPF-PPS admissions, documentation, treatment and discharge planning. Attendees will learn practical steps to tighten processes, avoid common audit triggers and protect reimbursement and reduce the risk of multimillion-dollar repayment demands.
In this timely session, Stacey Shillito, CDIP, CPMA, CCS, CCS-P, CPEDC, COPC, breaks down the complexities of Medical Decision Making (MDM) documentation so providers can confidently capture the true complexity of their care. Attendees will learn practical, efficient strategies to ensure documentation aligns with current E/M guidelines, supports accurate coding, and reduces audit risk, all without adding to charting time.
Join Ronald Hirsch, MD, FACP, CHCQM for The PEPPER Returns – Risk and Opportunity at Your Fingertips, a practical webcast that demystifies the PEPPER and shows you how to turn complex claims data into actionable insights. Dr. Hirsch will explain how to interpret key measures, identify compliance risks, uncover missed revenue opportunities, and understand new updates in the PEPPER, all to help your organization stay ahead of audits and use this powerful data proactively.
Stay ahead of the 2026-2027 audit surge with “Top 10 Audit Targets for 2026-2027 for Hospitals & Physicians: Protect Your Revenue,” a high-impact webcast led by Michael Calahan, PA, MBA. This concise session gives hospitals and physicians clear insight into the most likely federal audit targets, such as E/M services, split/shared and critical care, observation and admissions, device credits, and Two-Midnight Rule changes, and shows how to tighten documentation, coding, and internal processes to reduce denials, recoupments, and penalties. Attendees walk away with practical best practices to protect revenue, strengthen compliance, and better prepare their teams for inevitable audits.
Happy National Doctor’s Day! Learn how to get a complimentary webcast on ‘Decoding Social Admissions’ as a token of our heartfelt appreciation! Click here to learn more →
CYBER WEEK IS HERE! Don’t miss your chance to get 20% off now until Dec. 1 with code CYBER25
CYBER WEEK IS HERE! Don’t miss your chance to get 20% off now until Dec. 2 with code CYBER24
