With little fanfare, California on July 1 relaxed its breach reporting requirements under the 2008 state medical breach reporting law.^[1] In an echo of HIPAA, hospitals and other health care facilities are excused from reporting breaches that satisfy certain exceptions, including breaches that have a low probability of compromising medical information. Until now, they were required to report all unauthorized access and disclosure, regardless of their magnitude (or lack of it).

“It decreases our reporting burden substantially,” said Kathy Perkins, compliance officer at Pomona Valley Hospital Medical Center. “California’s patient privacy law has been one of the strictest in the nation, but I think the reporting mandate was so draconian that the California Department of Public Health could not keep up.”

The California Health and Safety Code requires a health care facility to “report any unlawful or unauthorized access to, or use or disclosure of, a patient’s medical information to the department no later than 15 business days after the unlawful or unauthorized access, use, or disclosure has been detected by the clinic, health facility, home health agency, or hospice.”^[2] The new regulation states that the definition of breach now excludes “a disclosure for which a health care facility or business associate, as applicable, determines that there is a low probability that medical information has been compromised based on a risk assessment of at least the following factors: (i) The nature and extent of the medical information involved, including the types of identifiers and the likelihood of re-identification; (ii) The unauthorized person who used the medical information or to whom the disclosure was made; (iii) Whether the medical information was actually acquired or viewed; and (iv) The extent to which the risk of access to the medical information has been mitigated.”^[3]