HIPAA Violation or Breach? What a Texas Practice Should Do Next
After a HIPAA violation or data breach, a Texas practice should contain the problem, preserve evidence, and run a documented risk assessment before deciding on notice. If a breach of unsecured patient information occurred, federal law sets a 60-day outer limit for notifying patients, and Texas law can require notice to the Attorney General sooner.
Violation, Incident or Breach: Know Which One You Have
The first question a HIPAA violation lawyer asks is which of these you have. The words are often used interchangeably, but they lead to different obligations.
| Term | What it means | Typical example |
|---|---|---|
| HIPAA violation | Any failure to follow the Privacy, Security or Breach Notification Rules | No risk assessment, a missing BAA, a staff member snooping in a chart |
| Security incident | An attempted or successful unauthorized access to information or systems | A phishing email clicked, a blocked intrusion attempt |
| Breach | An impermissible use or disclosure of unsecured protected health information that compromises it | A stolen unencrypted laptop, ransomware, records emailed to the wrong person |
Under HIPAA, an impermissible use or disclosure is presumed to be a breach unless a documented risk assessment shows a low probability that the information was compromised.
The First 72 Hours
- Contain it: disconnect affected systems, disable compromised accounts, recover misdirected records where possible.
- Preserve evidence: keep logs, emails and devices as they are. Do not wipe and rebuild until forensics is engaged.
- Notify your cyber insurer and follow its panel requirements, or coverage may be at risk.
- Engage counsel, and have counsel retain the forensic firm so the investigation has the best chance of staying privileged.
- Notify business associates involved, and check what your BAA requires of them.
- If law enforcement is involved, ask whether it wants notice delayed, and document that request.
The Four-Factor Risk Assessment
HIPAA requires the practice to weigh at least four factors before deciding a breach did not occur:
- The nature and extent of the information, including how sensitive it is and how easily it identifies the patient
- Who received or used the information without permission
- Whether the information was actually acquired or viewed
- How far the risk has been reduced, for example by a signed assurance that records were destroyed
Write the assessment down, even if the answer is that no notice is needed. Regulators ask for it.
The HIPAA Breach Notification Rule: Who You Must Tell, and When
| Who | When |
|---|---|
| Affected patients | Without unreasonable delay, and no later than 60 days after discovery |
| HHS, for breaches affecting 500 or more people | At the same time as patient notice |
| Prominent media, for 500 or more residents of one state | Within the same 60-day window |
| HHS, for breaches affecting fewer than 500 people | In an annual log submitted within 60 days after the end of the calendar year |
The 60 days is an outer limit, not a target. Waiting until day 59 without a reason is itself a problem.
Texas Notice Rules on Top of HIPAA
Texas has its own breach notification law for sensitive personal information, including health information. It requires notice to affected Texans, and when a breach affects 250 or more Texas residents, notice to the Texas Attorney General on a shorter timeline than the federal rule. The Texas Medical Records Privacy Act, expanded by House Bill 300, adds state penalties and gives the Attorney General enforcement power. Texas HB 300 also requires workforce training on state privacy law, so an incident is a good time to confirm that training is current.
HIPAA Violation Penalties
HIPAA violation penalties come from several directions:
- HHS Office for Civil Rights: tiered civil penalties based on how culpable the practice was, plus corrective action plans that can last years
- Texas Attorney General: state penalties under Texas privacy law and federal HIPAA enforcement authority
- Department of Justice: criminal charges for knowing, wrongful disclosure, such as selling records
- Licensing boards: discipline for providers when a privacy failure also reflects on professional conduct
- Patients and payers: lawsuits under state law and contract claims, even though HIPAA itself gives patients no private right to sue
The largest penalties usually follow not the breach itself but what investigators find around it: no risk analysis, missing BAAs, or a slow, undocumented response. Our article on common HIPAA violations covers prevention, and our business associate agreement guide covers vendor contracts.
When to Call a HIPAA Violation Lawyer
Bring in a HIPAA violation lawyer when any of these apply:
- Ransomware or any intrusion into the EHR or email
- A breach affecting many patients, or sensitive records such as mental health, HIV or substance use treatment
- A letter from the Office for Civil Rights or the Texas Attorney General
- A complaint from a patient or a former employee
- A breach caused by a vendor, where contract rights and cost-sharing are at stake
A HIPAA lawyer can direct the investigation, draft the notices, respond to regulators and work through the contract issues with vendors and insurers.
Quick Reference
- Contain and preserve first.
- Call the insurer and counsel before the forensic firm.
- Document a four-factor risk assessment.
- Patients within 60 days at most; Texas AG sooner if 250 or more Texans.
- Fix the cause and record what you changed.
Frequently Asked Questions
Is every HIPAA violation a breach?
No. Many violations, such as a missing policy, do not involve an impermissible disclosure. A breach requires that unsecured protected health information was used or disclosed in a way that compromised it.
Is ransomware a HIPAA breach?
Often, yes. HHS treats ransomware that encrypts patient data as a presumed breach unless a documented risk assessment shows a low probability that the information was compromised.
How long do I have to notify patients of a breach?
Without unreasonable delay and no later than 60 days after discovery under HIPAA. Texas law can require notice to the Attorney General on a shorter timeline when 250 or more Texans are affected.
Can a patient sue my practice for a HIPAA violation?
HIPAA does not give patients a private right to sue, but patients can bring claims under Texas law, and the Texas Attorney General can enforce both state and federal privacy rules.
Do I need a HIPAA violation attorney for a small breach?
Not always. A small, contained misdirected fax may only need a documented assessment and a log entry. Call a HIPAA violation attorney when systems were compromised, many patients are affected, or a regulator has made contact.
This article is general information about Texas healthcare law and is not legal advice. Reading it does not create an attorney-client relationship with Dike Law Group PLLC.
