---
title: Misdelivered Email Results in a HIPAA Data Breach
description: A common scenario in email security breaches is a billing service sending a bill to an incorrect email address. Even though the breach in this case study was caused by a business entity, the clinic still had a responsibility to analyze the risk and perform the breach notification.
image: https://files.norcal-group.com/hubfs/HIPPA-Breach-Analysis-Flowchart.jpg
---

- [Sign In](https://secure.proassurance.com?hsLang=en-us)
- g

Search Site

[Contact Us](https://www.proassurance.com/contact-us/?hsLang=en-us): **844-466-7225**

[![PRA-MMI-Logo®-RGB](https://www.norcal-group.com/hs-fs/hubfs/PRA-MMI-Logo%C2%AE-RGB.png?width=215&height=62&name=PRA-MMI-Logo%C2%AE-RGB.png)](https://www.norcal-group.com?hsLang=en-us)

 

- [About](https://norcal-group.com/about) 
    - [About Us](https://norcal-group.com/about)
- [Coverages](https://norcal-group.com/state)
- [Claims](https://www.proassurance.com/report-a-claim/)
- [Resources](https://www.norcal-group.com/resources) 
    - [HIPAA Resources](https://proassurance.com/hipaa)
    - [Website Accessibility](https://proassurance.com/accessibility)
- [Pay](https://www.norcal-group.com/pay)

## [Resource Library](https://www.norcal-group.com/library?hsLang=en-us)

# Misdelivered Email Results in a HIPAA Data Breach

 June 14, 2018

- [Tweet](https://twitter.com/share)

A common scenario in email security breaches is seen when a billing service sends a bill to an incorrect email address. In most practice arrangements, a third-party billing company will have signed a business associate agreement. According to HIPAA, business associates must inform covered entities when they discover a security breach; however, HHS gives covered entities and business associates flexibility in defining, in the business associate agreements, how and when a business associate should notify the covered entity of a potential breach.1 Consider the following case. (Please note that the following case focuses on the clinic’s responsibility to analyze the risk and perform the breach notification, even though the breach was caused by a business entity.)

For an explanation of HIPAA terms and more information about HIPAA data breaches in general, see the NORCAL Knowledge Library article, “[Preventing HIPAA Data Breaches: Case Studies and Best Practices](https://www.norcal-group.com/library/preventing-hipaa-data-breaches-case-studies-and-best-practices?hsLang=en-us).”

## HIPAA Breach Analysis Flowchart

The following flowchart outlines how a privacy or security incident is analyzed to determine whether a HIPAA breach has occurred. It forms the basis of the analysis in the case presented here.

![HIPPA-Breach-Analysis-Flowchart](https://files.norcal-group.com/hubfs/HIPPA-Breach-Analysis-Flowchart.jpg)In addition to federal HIPAA regulations, covered entities may also have to comply with state data breach laws. State laws vary on what triggers a breach notification obligation and the nature of breach notification obligations. This case study focuses on federal data breach notification laws. The Health Information & the Law website has an interactive map that provides links to [state health data security and breach notification laws](http://www.healthinfolaw.org/state).

## Case File

A family practice group had a business associate agreement with a billing company. An employee in the billing company sent an email with an attachment that contained patient information for 70 patients to an incorrect email address. Public records indicated the email address was active, but attempts to contact the individual associated with the email address were unsuccessful.

### HIPAA Breach Analysis

** Q. Was PHI involved?**

**A.** Yes.

**Q. Was the information on the compromised device encrypted, unusable, unreadable, or indecipherable?**

**A.** No. The PHI was not secured.

**Q. Does one of the three **[HIPAA disclosure exceptions](https://www.norcal-group.com/library/preventing-hipaa-data-breaches-case-studies-and-best-practices#hipaa-disclosure-exceptions)** apply?**

**A.** No. Although the transmission of the PHI to the incorrect email address was inadvertent, the PHI was sent to an individual who was not associated with the group or its business associates who could have accessed the PHI.

**Q. Is there a low probability that PHI has been compromised? (Risk Assessment)**

1. **Type of PHI**: The information in the email was sensitive and included numerous patient identifiers. In the wrong hands, there was a high possibility the PHI could be used in a manner adverse to the patients or could be used to further the unauthorized recipient’s own interests.
2. **Who took it/received it**: The data exposure was inadvertent, but whether the PHI would be further disseminated was unknown because the owner of the email address did not respond to inquiries.
3. **Ease of access**: The PHI was not encrypted and could be easily accessed.
4. **Mitigation**: There was nothing the practice could do to mitigate the potential misuse of the PHI.

**A.** The attorney who reviewed this case found that based on the risk assessment the clinic could not demonstrate a low probability that the PHI was compromised; therefore, a breach occurred. The practice was required to comply with the HIPAA breach notification requirements. Patient notification had to be accomplished within 60 days. However, because the breach involved fewer than 500 patients the group was advised it could maintain a log or other documentation of any other data breaches occurring in that year, and submit all of the breach notifications together not later than 60 days after the end of the calendar year.

## Medical Liability Risk Management Recommendations

In the foregoing case, the breach was caused by a business associate, but it just as easily could have been caused by an in-house billing department. The HIPAA Security Rule does not prohibit the inclusion of PHI in email, but the HIPAA standards for access control, integrity and transmission security require covered entities and their business associates to have policies and procedures in place that protect the security of PHI in email. If email is not encrypted, HIPAA requires a risk assessment of how the integrity of the PHI will be protected. Consider the following recommendations:2

- Consider using the encrypted messaging capabilities in your EHR (if available) to send PHI instead of using general email applications such as Outlook.
- Encrypt email.
- Put a disclaimer on email to mitigate a security breach if PHI is sent to an unintended recipient. For example:
  
  *This email message and any attachment(s) transmitted with it are intended only for the use of the recipient(s) named above. This message may contain privileged and confidential information, including patient information protected by federal and state privacy laws. If you are not an intended recipient, you may not review, copy or distribute this message. If you have received this message in error, please notify the sender immediately by reply email and delete the original message.
  
  *
- Employ interactive software (e.g., a pop-up box) that prevents or warns senders when they’re emailing PHI. Remind senders to double check the email address.
- Give patients the option of receiving unencrypted email only after they had been advised of and consented to the risk of data breach. 
    - The HHS article “[Does the HIPAA Privacy Rule permit health care providers to use e-mail to discuss health issues and treatment with their patients?](https://www.hhs.gov/hipaa/for-professionals/faq/570/does-hipaa-permit-health-care-providers-to-use-email-to-discuss-health-issues-with-patients/index.html)” answers questions about email communication with patients.
- Include email security requirements in business associate contracts.

## More Information About Preventing HIPAA Data Breaches

- Overview: [Preventing HIPAA Data Breaches: Case Studies and Best Practices](https://www.norcal-group.com/library/preventing-hipaa-data-breaches-case-studies-and-best-practices?hsLang=en-us)
- Best Practices: [Mobile Device Policies for Preventing HIPAA Data Breaches](https://www.norcal-group.com/library/mobile-device-policies-for-preventing-hipaa-data-breaches?hsLang=en-us)
- Best Practices: [Best Practices for Preventing HIPAA Data Breaches by Criminal Hackers](https://www.norcal-group.com/library/best-practices-for-preventing-hipaa-data-breaches-by-criminal-hackers?hsLang=en-us)
- Case Study Comparison: [HIPAA Data Breaches and PHI on Stolen Laptops](https://www.norcal-group.com/library/case-study-comparison-hipaa-data-breaches-and-phi-on-stolen-laptops?hsLang=en-us)
- Closed Claim Case Study: [Employee Voyeurism Leads to a HIPAA Data Breach](https://www.norcal-group.com/library/employee-voyeurism-leads-to-a-hipaa-data-breach?hsLang=en-us)
- Closed Claim Case Study: [Unsecured PHI on a Lost Flash Drive Results in a HIPAA Data Breach](https://www.norcal-group.com/library/unsecured-phi-on-a-lost-flash-drive-results-in-a-hipaa-data-breach?hsLang=en-us)

**Additional Resources for Policyholders**

Guidance and additional information on the HIPAA Security Rule and on medical records security, access and release are available to all NORCAL policyholders by contacting a NORCAL Risk Management Specialist at 855.882.3412.

**Information and Network Security Coverage**

Call NORCAL Customer Service at 844.4NORCAL or visit our [Information and Network Security coverage](https://www.norcal-group.com/information-network-security?hsLang=en-us) page for more information about this coverage available at no additional cost as part of the Health Care Professional (HCP) policy.

[![This content from Claims Rx](https://no-cache.hubspot.com/cta/default/508142/35fb4f75-fa17-4779-a029-6a0441b4a787.png)](https://cta-redirect.hubspot.com/cta/redirect/508142/35fb4f75-fa17-4779-a029-6a0441b4a787)

## References

1. [Federal Register Volume 78, Number 17](https://www.gpo.gov/fdsys/pkg/FR-2013-01-25/html/2013-01073.htm) (Friday, January 25, 2013), Page 5656. (accessed 5/14/2018)

2. SCRYPT Corporation. “[Email to provider revealed as the reason for recent Atlanta data breach](https://www.scrypt.com/blog/email-to-provider-revealed-as-the-reason-for-recent-atlanta-data-breach/).” August 18, 2015. (accessed 5/14/2018)

## Additional Linked Sources

Health Info & the Law Project. “[States](http://www.healthinfolaw.org/state).” (accessed 5/14/2018)

U.S. Department of Health and Human Services, Office for Civil Rights (OCR). “[Does the HIPAA Privacy Rule permit health care providers to use e-mail to discuss health issues and treatment with their patients?](https://www.hhs.gov/hipaa/for-professionals/faq/570/does-hipaa-permit-health-care-providers-to-use-email-to-discuss-health-issues-with-patients/index.html)” December 15, 20008. (accessed 5/14/2018)

 Filed under: [Digital Health](https://www.norcal-group.com/library/topic/digital-health), [Privacy & HIPAA](https://www.norcal-group.com/library/topic/privacy-hipaa), [Cybersecurity](https://www.norcal-group.com/library/topic/cybersecurity), [Case Study](https://www.norcal-group.com/library/topic/case-study), [Practice Manager](https://www.norcal-group.com/library/topic/practice-manager), [Information Security](https://www.norcal-group.com/library/topic/information-security)

###  Topics 

Please select Bad Outcomes & Complications Business Continuity Business Operations Community Health Consultations Cosmetic & Reconstructive Procedures Cultural Competency & Cultural Respect Cybersecurity Diagnosis & Testing Digital Practice Electronic Health Records (EHR) General Liability HIPAA Privacy & Confidentiality Industry Trends Information Security Informed Consent Leadership Litigation & Claims Marketing & Practice Building Medical Errors & Apology Medical Ethics Medical Records & Documentation Medication Errors Opioids Pain Management Patient Communication Patient Relationship Personal Finance & Career Philanthropy & Community Involvement Physician Burnout Physician Ratings Physician Wellness Practice Communication Practice Drift Practice Management Prescribing & Medication Public Relations & Communication Regulation & Compliance Reputation Management Unanticipated Outcomes Vicarious Liability

###  Specialties 

Please select Emergency Medicine Family Practice Mental & Behavioral Health Obstetrics & Gynecology Oncology Ophthalmology Orthopedics Pain Management Specialist Pediatrics Plastic & Cosmetic Surgery Radiology

### Recently Added

Interested in NORCAL Group?

**Contact Your Agent/Broker** or call 844.4NORCAL today

* NORCAL Group, now part of ProAssurance, includes NORCAL Insurance Company and its affiliated companies.

[![AM Best](https://www.norcal-group.com/hubfs/Norcal_Mutual_Images/graphic_am-best.png)](https://www.norcal-group.com/ambest?hsLang=en-us)

- [About](https://norcal-group.com/about) 
    - [About Us](https://norcal-group.com/about)
- [Coverages](https://norcal-group.com/state)
- [Claims](https://www.proassurance.com/report-a-claim/)
- [Resources](https://www.norcal-group.com/resources) 
    - [HIPAA Resources](https://proassurance.com/hipaa)
    - [Website Accessibility](https://proassurance.com/accessibility)
- [Pay](https://www.norcal-group.com/pay)

© 2001 - 2024 ProAssurance  
All rights reserved

- [844-466-7225 ](tel:18444667225)
- [Privacy Policy](https://proassurancegroup.com/privacy-policy?hsLang=en-us)
- [Terms of Use](https://www.norcal-group.com/terms?hsLang=en-us)
- [Website Accessibility](https://www.norcal-group.com/accessibility?hsLang=en-us)

```json
{
  "@context" : "http://schema.org",
  "@type" : "InsuranceAgency",
  "contactPoint" : {
    "@type" : "ContactPoint",
    "contactType" : "customer service",
    "telephone" : "1.844.466.7225"
  },
  "description" : "The NORCAL Group of companies provide medical professional liability insurance to physicians, health care extenders, medical groups, hospitals, community clinics and allied health care facilities throughout the country.",
  "foundingDate" : "1975-01-01",
  "foundingLocation" : "California",
  "legalName" : "NORCAL Mutual Insurance Company",
  "logo" : "https://files.norcal-group.com/hubfs/Website/Logos/NORCAL-Group-Logo-X-18.png",
  "name" : "NORCAL Group",
  "potentialAction" : {
    "@type" : "SearchAction",
    "query-input" : "required name=search_term_string",
    "target" : "http://www.norcal-group.com/search?search={search_term_string}"
  },
  "subOrganization" : [ "Medicus", "FD Insurance", "NORCAL Specialty Insurance Company", "PMSLIC" ],
  "url" : "http://www.norcal-group.com"
}
```