Kendall Cortelyou-Ward, PhD

 The study’s objectives were to explore the impact of personal/organizational knowledge, prior breach status of organizations, and framed scenarios on the choices made by privacy officers regarding the decision to report a breach.

 A survey was completed of 123 privacy officers who are members of the American Health Information Management Association (AHIMA).

 The study used primary data collection through a survey. Individuals listed as privacy officers within the AHIMA were the target audience for the survey. Descriptive statistics, logistic regression, and predicted probabilities were used to analyze the data collected.

 The percentage of privacy officers who chose to report a breach to the Office for Civil Rights varied by scenario: scenario 1 (general with little information), 39%; scenario 2 (4-factor risk assessment, paper records), 73.2%; scenario 3 (4-factor risk assessment, ransomware case), 91.9%. Several factors affected the response to each scenario. In scenario 1, privacy officers with a Certified in Healthcare Privacy and Security (CHPS) credential were less likely to report; those who previously reported a prior breach were more likely to report. In scenario 2, privacy officers with a bachelor’s degree or graduate education were less likely to report; those who held the CHPS or coding credential were less likely to report.

 Study findings show there are gray areas where privacy officers make their own decisions, and there is a difference in the types of decisions they are making on a day-to-day basis. Future guidance and policies need to address these gaps and can use the insight provided by the results of this study.

This study presents information regarding the decisions that health care privacy officers make about reporting a data breach, including factors that can affect the decision process, such as personal/organizational knowledge, prior breach status, and framed scenarios.

The percentage of privacy officers who chose to report a breach varied by scenario. Credentials, prior breach reporting, and education level had significant effects on the decision to report depending on the scenario.

Study findings show that there is a gray area where privacy officers have to make their own decisions, and there is a difference in the types of decisions they are making on a day-to-day basis.

The findings from this study, including the results showing the impact of education, credentials, and prior experience on the decision to report a breach, can provide insight to address gray areas in future guidance and legislation.

The Health Information Technology for Economic and Clinical Health Act strengthened Health Insurance Portability and Accountability Act (HIPAA) laws, including those surrounding enforcement, penalties, and breach notification.

 Under these guidelines, a health care organization must notify patients and the Office for Civil Rights (OCR) of instances of breached protected health information (PHI) as defined by “acquisition, access, use, or disclosure of [PHI] in a manner not permitted by the HIPAA Privacy Rule which compromises the security or privacy of the [PHI].”

When a breach occurs, a facility must assume that there is harm to the patient unless, after completion of a 4-factor risk assessment, they can prove that there was sufficient low probability of compromise to the information.

 The 4-factor risk assessment must address the (1) nature and extent of the breach, (2) the individual who accessed or was disclosed the information, (3) whether the information was acquired/viewed, and (4) the extent to which the risk was mitigated.

 Although the guidelines are in place, interpretation of them can be subjective. Therefore, some issues may influence decisions outside of the 4-factor risk assessment. These issues may include past history with breaches (prior reporting experience), current trends (as identified by OCR with guidance), and financial liability (cost to organization of reporting vs not reporting). This means that there are gaps in the policy where individuals and organizations are making decisions about patient privacy concerns.

Federal policy instituted that all covered entities are required to have a designated privacy official to develop and implement the facility’s privacy/security policies and procedures.

 Many facilities have termed this position as a privacy officer. Although there are guidelines in the case of HIPAA and breach notifications, the organization and its privacy officer(s) are responsible for determining an individual organization’s breach reportability status. Matters related to patients and their privacy are now subject to internal determinations made by health care organizations, which could cause significant harm if not handled appropriately.

Reporting to OCR and/or the patient can open an organization to risk of financial and possible criminal penalties. There is a risk of harm to the organization’s reputation, which could affect patient visits and market share, thereby negatively affecting future revenue. There are high costs associated with maintaining patient privacy, as well as high costs when patient privacy is breached, which may be taken into account when deciding whether to report a breach.

 Therefore, privacy officers might view risk differently and their processes may vary dependent on their knowledge of the policy, the status of previous reported breaches, and their framing of an incident.

This is the first study to focus on the decisions that health care privacy officers are making in regard to patient data breaches. Privacy officers may be weighing the implications of reporting, and that knowledge may affect their choice to report breaches that do occur to the OCR. This study aims to explore how personal and organizational knowledge, prior breach status, and scenario framing influence how a privacy officer makes determinations about reporting a data breach.

This study utilized primary data through a research survey conducted over a single-year time period. The collection of primary data was necessary due to a lack of prior research of this format and subject. A subject matter expert provided guidance on the scenarios. A pilot test was conducted to counteract any bias and to provide feedback on ease of use. The University of Central Florida Institutional Review Board completed a review of the study and questionnaire.

The population targeted for this study were members of the American Health Information Management Association (AHIMA) who were designated as privacy officers. AHIMA has taken the lead in the United States regarding HIPAA and privacy. AHIMA offers educational program-credentialing exams, including a specialized credential, Certified in Healthcare Privacy and Security (CHPS).

 Privacy officers are likely to be AHIMA members due to the nature of the regulations ensuring access, privacy, and security of patient records. Survey questionnaires included demographic and personal information questions, prior breach reporting details, and hypothetical scenarios that had several outcomes regarding data breach reporting.

Variables to Characterize Privacy Officers and Breaches

Variables used to characterize privacy officers include (1) age,

 (2) gender, (3) education level, (4) credentials, (5) department of employment, (6) number of years worked in health care, (7) number of years worked in health care privacy, (8) percentage of years worked in health care privacy out of health care career years, (9) knowledge level, (10) facility classification, (11) state privacy laws, (12) organization’s profit status, and (13) if the respondent has previously reported a breach to the OCR. Credentials included Registered Health Information Administrator or Registered Health Information Technician, CHPS, and coding credential (including all coding-based credentials). The department in which the privacy officer worked was captured into the following categories: executive, health information management/information technology/other, and compliance. Participants were asked if they were in a state with additional health care privacy laws, and a list was provided identifying these states. Facilities in which the privacy officer worked were categorized as acute care hospital, integrated health delivery system, and other.

The dependent variables are the privacy officers’ responses to whether they would report a breach in response to 3 scenarios provided through the survey. The response options for the outcome variable in each scenario were yes or no.

Breach scenario 1 asked if the respondent would report or not report in an instance where the breach was not clearly identified as reportable (question #19).

Breach scenario 2 was a paper health record scenario in which a facility had a break-in. Although no PHI was stolen from the facility, the individual who broke in had access to 450 paper medical records in the office. The 4-factor risk assessment was provided and included areas of concern. The choices to report or not report highlighted the benefits of reporting (question #20).

Breach scenario 3 was a ransomware scenario that involved a phishing email. Access was restored, but the attacker potentially had access to 750 unsecured (unencrypted) patient records. The 4-factor risk assessment was provided and included areas of concern. The decisions to report or not report highlighted the potential issues with reporting (question #21).

The first scenario was a simple statement whereas the second and third were more complex. The primary distinctions between the second and third scenarios are the method (paper vs electronic) and the factors that come with those methods (amount of records potentially breached). The scenarios were designed with a level of real-world ambiguity to allow respondents the opportunity to make either choice, report or not report. The scenarios are listed at the end of the survey in the 

AHIMA membership included 5293 individuals who held the director/officer classification. Of these individuals, 479 were identified with privacy in their title and were contacted to participate in the study. Using a margin of error of 8%, a significance (α) level of 0.05, and a population of 479, the minimum sample size required was 115 individual responses.

 There were 123 completed surveys from respondents, resulting in an appropriate sample size for robust analyses.

Descriptive statistics, logistic regression, and predicted probabilities were used to characterize the data. For all regression models, the predictor variables included age, gender, department, state laws, facility classification, profit status, years in health care, years of experience in health care privacy, education level, health care credentials, knowledge level, prior breach status, breach number, and breach effects. The 3 dependent variables are breach scenario 1, breach scenario 2, and breach scenario 3.

For breach scenario 1, 39% of respondents chose to report. For breach scenario 2, 73.2% of respondents chose to report. For breach scenario 3, 91.9% of respondents chose to report (

The CHPS credential (odds ratio [OR], 0.144; 

 = .018) was significantly associated with reporting a breach in scenario 1 (

 = .010) was also significant. Due to the high OR of the prior breach variable, a univariate model was attempted to understand the impact that particular variable had on the model; however, the numbers were not sufficient to run the logistic regression models.

Having a bachelor’s degree (OR, 0.036; 

 = .026) was significantly associated with reporting a breach in scenario 2 (

 = .006) was significant as well. The third variable that was significant was coding credential (OR, 0.026; 

Although the study met the overall assumptions for logistic regression, the data set was homogenous in the outcome and thus there was no need to run a model of predicting factors. This is shown in the 

. The first 2 breach scenarios had variation in the response and breach scenario 3 had a vast majority, 91.9% (113/123 responses), who chose “yes” to indicate that they would report the breach.

After running the logistic regression models, adjusted predicted probabilities were calculated (

). For breach scenario 1, privacy officers who hold the CHPS credential were significantly less likely to report a breach in scenario 1 (predicted probability of 12.7% vs 42.7% for those who do not have the credential). Privacy officers who have previously reported a prior breach were significantly more likely to report a breach in scenario 1 (predicted probability of 47.2% vs 20.9% among those with no prior reported breaches).

For breach scenario 2, privacy officers who have a bachelor’s or graduate education were significantly less likely to report a breach in scenario 2 (predicted probability of 56.2% for those with a graduate education and 71.6% for those with a bachelor’s degree vs 98.2% for those with a high school diploma or an associate’s degree). Privacy officers who hold the CHPS credential were significantly less likely to report a breach in scenario 2 (predicted probability of 57.5% vs 76% for those who do not have the credential). Privacy officers who hold a coding credential were less likely to report a breach in scenario 2 (predicted probability of 26.1% vs 76.7% for those who do not have the credential).

Breach scenario 3 was not included in the predicted probability models due to the homogeneity of the data.

Overall, this study found that several variables affect the choice to report a breach for the scenarios. Those with higher levels of education, bachelor’s and graduate degrees, are less likely than respondents with only a high school or associate’s degree to report a breach in scenario 2. The CHPS credential was the strongest predictor, as we found that privacy officers who hold this credential are less likely to report a breach. Therefore, those with a higher level of demonstrated knowledge, through education and credentials, may be less likely to report a breach dependent on the scenario.

Privacy officers who had reported a prior breach were more likely to report an ambiguous breach in the future if they knew little about the incident. However, when participants were provided additional detail and presented with options, this likelihood was not present. Therefore, those who have dealt with the process previously may err on the side of caution with little information. However, they may become more discerning when presented with additional information.

It is vital that privacy officers understand their reference points and how their framing of an incident can affect their response. Education levels significantly affected reporting decisions, which may indicate a need for higher participation in degree programs and/or certifications by privacy officers. This is an area that could be expanded upon to ensure that those individuals in a facility making decisions are fully informed regarding the requirements to report a breach, the impact on the patient and facility if the wrong choice is made, and how their own personal background and experience can inform their decisions.

There is an indication of a need for privacy officer qualifications by the credential results. The CHPS credential was a strong predictor, lending credence to the value of the advanced knowledge required to obtain the credential and the impact it has on the decision-making process. An interesting finding was that having a coding credential was a predictor of reporting. A review of the coding credential domains and subdomains may show specific content that is valuable for privacy officers. A focus on compliance aspects of the credentials may be beneficial.

An interesting finding of the study was the demographics of the responses to the 3 breach scenario questions. When reviewing them at face value, there was a change in response to the type of scenario. The first scenario was a simple statement, and the majority responded that they would not report. When provided a detailed scenario based on paper records, the majority chose to report. Finally, when provided a detailed scenario based on ransomware, the overwhelming majority chose to report. The shift from the second to the third scenario may have been affected by the contextual factors of the study, including the number of records affected and the responses to the 4-factor risk assessment that were provided. Respondents may have chosen to err on the side of caution due to the ambiguity of ransomware attacks, where the level of compromise to the information may not be as evident.

Privacy officers should review the results of this study carefully and utilize them to enhance their ability to manage breach determinations in their workplace. Higher levels of education, credentials, and knowledge base may enable privacy officers to market themselves better in the workplace and enhance their positions within health care organizations.

The results of this study indicate that breach determination is made on a case-by-case basis and dependent on individual decisions. However, health care organizations can utilize these results to develop plans with their internal and external stakeholders in the event of a breach of patient information. Implications of a breach are shaped by the type, category, method of access, and number of patients affected; however, it is important to have these high-level plans in place so everyone involved has a basic understanding. Development of these plans should include discussions of when reporting is appropriate and why it is important to report in cases where it is appropriate regardless of the consequences.

This recommendation is in line with industry trends. The Emergency Preparedness and Security Trends in Healthcare survey identified that cyberattacks are the third-highest safety concern of health care organizations.

 A recent study found that although facilities may take steps to protect privacy, including the use of advanced information technology systems along with biometric and 2-factor security systems, breaches still occur with paper and electronic records.

An example of the type of plans needed can be found in the case of Anthem, a health care insurance company that experienced one of the largest breaches of 2015, affecting 80 million individuals.

 From that incident, the author of the PRNEWS article “7 PR Lessons From the Largest Healthcare Data Breach in History” created a set of lessons that companies should consider for a crisis communication plan in the case of a breach of patient information. These lessons include early and easy-to-understand transparency with the public and authorities, which includes a sincere apology and the offer of compensation to victims to help reestablish loyalty.

 As indicated by this study, privacy officers need the knowledge and education to assist in the development of these plans.

OCR has previously provided guidance on areas of breach determination; however, the process still has gaps where privacy officers are making their own decisions. OCR can use the findings of this study to help identify and address these gaps. Further guidance should be issued to help with the areas of ambiguity and perhaps scenario-based guidance as appropriate.

The study included self-reported measures, which may have led to bias in the results, primarily with the self-rating of knowledge level. Furthermore, the study population was restricted to privacy officers who were members of AHIMA, which may affect the generalizability of the results to all privacy officers in the United States. Furthermore, although this study found that education and certifications are predictive of likelihood to report breaches, this survey did not quantify or take into account the quality of education that these privacy officers may have received. The survey did not include an area for respondents to provide a rationale for their decisions to report/not report, which can limit the findings in terms of correlation vs causation. This would be an area to expand upon for future research with qualitative studies.

There was no need to run the third model based on the third scenario, as there was not enough variation in the dependent variable. The data still provided a wealth of information for the theoretical and practical implications, but it was not included in the statistical models.

The subject of the study can be considered sensitive to organizations and could have resulted in nonparticipation from those contacted, as they may have been restricted from participating or felt it inappropriate due to their facility’s legal requirements.

The purpose of this study was to explore the impact that personal and organizational knowledge and scenario framing had on the decisions that privacy officers made in regard to reporting privacy breaches to the OCR. The findings of the study provided industry and policy implications.

Health care privacy is paramount due to the sensitive nature and amount of information collected by care providers. Although there are federal and state policies in place to protect individual patient privacy, the findings of this study show that there is a gap where privacy officers have to make their own decisions, and there is a difference in the types of decisions they are making on a day-to-day basis.

With the significant results of this study identified as education level–, credential level–, and scenario-based, they are indicative of a need for educational opportunities and potential requirements for designated privacy officers. This includes initial levels of education, as well as continuing education requirements to ensure the individuals stay up to date on the current trends and threats in health care. Educational initiatives may also be beneficial at the executive level because these individuals may underestimate the importance of privacy initiatives, which could lead to underreporting of breaches. These educational initiatives may include scenario-based training to identify areas of concern and confusion for their organization. This can assist in developing well-rounded policies and procedures for breach reporting. Future research at the executive level of understanding and decision-making is crucial for policy implications. Both levels, privacy officer and executive positions, would benefit from scenario-based educational opportunities as well.

Health care has a variety of settings, from small individual physician practices to large national integrated delivery systems. The types of care vary from basic preventive care to high-impact invasive treatment. These varieties of settings and care provision types lead to difficulties in identifying a single answer to protecting patient information. The types of systems and information processes used among these are more a best-of-fit than a best-of-breed for this reason. Future guidance and policies need to address these gaps and can use the insight provided by this study of areas that influence the decision-making process.

A driving force behind this study was to understand how privacy officers make decisions, because if they make a wrong decision, it can be extremely detrimental to patients. The findings from the study indicate that higher knowledge levels of respondents equate to a lower likelihood of reporting, which can be positive for a facility. However, if the case was reportable, it may be harmful to patients. It is essential that the federal government take into account the regulatory burden placed on businesses; however, protecting the privacy of patients must still be a priority.


 Department of Health Management and Informatics, College of Health & Public Affairs, University of Central Florida (AW, KC-W, AN), Orlando, FL; Pharmacy Quality Alliance (MHG), Alexandria, VA.

 The authors report no relationship or financial interest with any entity that would pose a conflict of interest with the subject matter of this article.

 Concept and design (AW, KC-W, AN); acquisition of data (AW); analysis and interpretation of data (AW, KC-W, MHG); drafting of the manuscript (AW, AN); critical revision of the manuscript for important intellectual content (AW, KC-W, MHG, AN); statistical analysis (AW); administrative, technical, or logistic support (AW); and supervision (KC-W, MHG).

 Amanda Walden, PhD, RHIA, CHDA, Department of Health Management and Informatics, College of Health & Public Affairs, University of Central Florida, 528 W Livingston St, Ste 401, Orlando, FL 32801. Email: amanda.walden@ucf.edu.

Health Information Management Concepts, Principles, and Practice

. 5th ed. American Health Information Management Association; 2016.

2. Office for Civil Rights. Annual report to Congress on breaches of unsecured protected health information for calendar years 2009 and 2010. Kaiser Family Foundation. 2011. Accessed November 16, 2020. https://www.kff.org/wp-content/uploads/sites/2/2012/06/compliancerept.pdf

3. Bendix J. What the HIPAA omnibus rule means for your practice. 

4. Analysis of modifications to the HIPAA privacy, security, enforcement, and breach notification rules under the Health Information Technology for Economic and Clinical Health Act and the Genetic Information Nondiscrimination Act; other modifications to the HIPAA rules. American Health Information Management Association. January 25, 2013. Accessed June 4, 2014. https://library.ahima.org/PdfView?oid=106127

5. American Health Information Management Association. Performing a breach risk assessment. 

6. Modifications to the HIPAA privacy, security, enforcement, and breach notification rules under the Health Information Technology for Economic and Clinical Health Act and the Genetic Information Nondiscrimination Act; other modifications to the HIPAA rules. 

7. Liginlal D, Sim I, Khansa L, Fearn P. HIPAA privacy rule compliance: an interpretive study using Norman’s action theory. 

. 2012;31(2):206-220. doi:10.1016/j.cose.2011.12.002

8. Coate D, MacDonald K. Projecting the budget impacts of HIPAA. 

9. Fleming NS, Culler SD, McCorkle R, Becker ER, Ballard DJ. The financial and nonfinancial costs of implementing electronic health records in primary care practices. 

. 2011;30(3):481-489. doi:10.1377/hlthaff.2010.0768

10. Adler-Milstein J, Green C, Bates D. A survey analysis suggests that electronic health records will yield revenue gains for some practices and losses for many. 

. 2013;32(3):562-570. doi:10.1377/hlthaff.2012.0306

11. McMillan M. The cost of IT security. 

12. Khansa L, Cook DF, James T, Bruyaka O. Impact of HIPAA provisions on the stock market value of healthcare institutions, and information security and other information technology firms. 

. 2012;31(6):750-770. doi:10.1016/j.cose.2012.06.007

13. Third annual patient privacy & data security study. Ponemon Institute. December 6, 2012. Accessed June 4, 2017. http://www.ponemon.org/research/ponemon-library/security/third-annual-patient-privacy-data-security-study.html

14. Fourth annual benchmark study on patient privacy & data security. Ponemon Institute. March 26, 2014. Accessed June 4, 2017. http://www.ponemon.org/research/ponemon-library/security/fourth-annual-benchmark-study-on-patient-privacy-data-security.html

15. Fifth annual benchmark study on patient privacy & data security. Ponemon Institute. May 27, 2015. Accessed June 4, 2017. http://www.ponemon.org/research/ponemon-library/security/fifth-annual-benchmark-study-on-privacy-security-of-healthcare-data.html

16. Sixth annual benchmark study on patient privacy & data security. Ponemon Institute. May 12, 2016. Accessed June 4, 2017. http://www.ponemon.org/research/ponemon-library/security/sixth-annual-benchmark-study-on-privacy-security-of-healthcare-data.html

17. Campbell K, Gordon LA, Loeb MP, Zhou L. The economic cost of publicly announced information security breaches: empirical evidence from the stock market. 

. 2003;11(3):431-448. doi:10.3233/JCS-2003-11308

18. Khansa L, Liginlal D. Quantifying the benefits of investing in information security. 

. 2009;52(11):113-117. doi:10.1145/1592761.1592789

19. Andoh-Baidoo F, Amoako-Gyampah K, Osei-Bryson K. How internet security breaches harm market value. 

. 2010;8(1):36-42. doi:10.1109/MSP.2010.37

20. Certified Health Data Analyst (CHDA). American Health Information Management Association. Accessed September 1, 2017. https://www.ahima.org/certification/chda

21. Sample size calculator. Raosoft. Accessed June 6, 2017. http://www.raosoft.com/samplesize.html

Internet, Phone, Mail, and Mixed Mode Surveys: The Tailored Design Method

23. Rave Mobile Safety survey unearths discrepancies about which emergencies occur at facilities and the preparedness plans they have in place. News release. Rave Mobile Safety; October 23, 2018. Accessed November 4, 2018. https://www.prnewswire.com/news-releases/rave-mobile-safety-survey-unearths-discrepancies-about-which-emergencies-occur-in-healthcare-facilities-and-the-preparedness-plans-they-have-in-place-300735983.html

24. Gabriel MH, Noblin A, Rutherford A, Walden A, Cortelyou-Ward K. Data breach locations, types, and associated characteristics among US hospitals. 

25. Keeve A. 7 PR lessons from the largest healthcare data breach in history. PRNEWS. February 1, 2016. Accessed September 23, 2018. https://www.prnewsonline.com/7-pr-lessons-from-the-largest-healthcare-data-breach-in-history/

Articles

To Report or Not Report Health Care Data Breaches

Grace Medical Home is a faith-based organization with a mission of providing the highest quality of care possible to the medically underserved in the central Florida region. One of Grace’s objectives since it started seeing patients in 2010 was to transition its primary care clinic into a fully functioning patient-centered medical home (PCMH) recognized by the National Committee for Quality Assurance.&ensp;Many potential barriers limited Grace, especially that it is a free clinic that operates primarily on donations and is staffed mostly by volunteers. Despite these and other limitations, Grace managed to achieve PCMH recognition in October 2014 through a focused team-based approach and hands-on guidance from a Regional Extension Center’s PCMH team. Grace was 1 of 10 free clinics that achieved PCMH recognition at that time. Currently, there is limited published information about free clinics transitioning to the PCMH model.

The American Journal of Accountable Care. 2018;6(2):30-35

A patient-centered medical home (PCMH) is a care delivery model that pursues care delivery improvement through primary care services. The PCMH model was designed to meet patient needs, increase access to care, and enhance overall quality, all while being more cost&shy;-efficient. In 2007, multiple primary care associations collaborated to develop the Joint Principles of the Patient-Centered Medical Home, which established a comprehensive primary care model for children and adults.

 As it relates to medical expenditures, empirical study results show that PCMHs help control costs by optimizing patient access and population health management, which reduces costly hospital and emergency department visits.

 With recent value-based payment models being implemented, a delivery system that focuses on primary care and prevention is key to helping achieve the goals of the healthcare Triple Aim: improving the patient experience of care (including quality and satisfaction), improving the health of populations, and reducing the per capita cost of healthcare.

 PCMHs provide continuous, comprehensive care to patients, who build personal relationships with their care providers, including nurse practitioners and physician assistants.

 Predominantly, PCMHs use a team-based delivery model usually led by a primary care provider.5 However, this model is also attractive to nontraditional methods of healthcare delivery, including free clinics.

The National Committee for Quality Assurance (NCQA) has a recognition program that is the most widely adopted PCMH evaluation program in the United States. Most PCMH transformations occur following the NCQA standards,

 because the NCQA closely aligns practice transformation into a PCMH with achieving the Triple Aim and lends itself to high-quality care delivery. This has captured the attention of healthcare stakeholders, including providers, policy makers, and purchasers. The goals of this paper are to highlight activities associated with PCMH transformation, inform readers about how a free clinic mitigated barriers and motivated drivers, and describe lessons learned during this transition.

In 2008, Marvin Hardy, MD, founded Grace Medical Home (“Grace”), a nonprofit free clinic located in Orange County, Florida. Soon after, Kirsten Carter, MD, an Orlando internal medicine physician, joined Hardy in his journey to open Grace’s doors. The majority of Grace’s funding comes from private donors. Grace has a small staff of paid employees and many clinical and nonclinical volunteers. The clinic operates under a holistic model of care, providing a host of onsite ancillary services, including nutrition counseling, pharmacy, laboratories, x-rays, and mental health counseling, all of which lend themselves to supporting the PCMH model. The clinic serves more than 3000 patients in central Florida, all of whom do not qualify for Medicaid but cannot afford private insurance. The eligibility criteria include currently living in Orange County, Florida, for at least 2 months; earning less than 200% of the federal poverty line; being uninsured; being 65 years or younger; and being employed (currently or in the last 6 months), a full-time student, or a single parent. The population of Orange County is 1.2 million residents, 25% of whom are uninsured.

 The county is approximately 70% white and 23% black, and 30% identify as Hispanic.

Health information technology (IT) and engaged teams of medical professionals help patients become more involved with their own healthcare. The decision for Grace to pursue PCMH transformation and NCQA recognition was driven by the model’s positive impact on population health needs.

Regional Extension Centers (RECs) are organizations originally funded under the Health Information Technology for Economic and Clinical Health Act (HITECH) to support specific healthcare providers with the implementation of electronic health record (EHR) systems. Building on this business model, some RECs now promote the progression of innovative health IT and the adoption of best practices throughout the medical community. This expansion of services has extended to assisting with the transformation of healthcare delivery systems.

One of the requirements within HITECH was that RECs should create sustainability plans for continuous operation once the original funding had been exhausted. The REC at the University of Central Florida’s College of Medicine chose to implement PCMH transformation and recognition as one of several additional services to continue to assist providers in the central Florida community, with Grace presenting particular challenges due to its status as a free clinic. The REC established a program that focused on PCMH transformation using change concepts, Plan-Do-Study-Act (PDSA) improvement activities, and robust measurement. It also established a core team of NCQA PCMH Certified Content Experts to provide the practice support necessary to making substantive changes in a clinical setting.

In 2013, Grace began its PCMH transformation with the assistance of the REC. Initially, the project experienced a slower-than-anticipated start due to a variety of factors, including staffing resources and other pressing priorities that go with running a free clinic. Eventually, however, Grace leadership worked closely with the REC team and engaged key Grace clinical leaders (3 physicians and 1 nurse practitioner, all specializing in family medicine and pediatrics) to spearhead Grace’s PCMH transformation.

Grace earned NCQA recognition under the PCMH 2011 version of the standards and guidelines.

 To achieve this PCMH transformation, a practice must satisfy, at a minimum, the following 6 “must-pass” elements: (1A) access during office hours, (2D) use data for population management, (3C) care management, (4A) support&#8203; self-care process, (5B) referral tracking and follow-up, and (6C) implement continuous quality improvement.

These 6 elements are the core PCMH activities and the baseline requirements for NCQA recognition, but practices must satisfy many other requirements under the PCMH standards and guidelines. Moreover, Grace’s achievement of PCMH recognition indicates that the practice delivers patient-centered care through these PCMH activities despite the challenges of providing this model of care in the environment of a free clinic.

Grace’s approach to satisfy each of the basic elements, although not unique, was based on the realities of its limited resources and staffing model. Grace’s small core staff relies on the volunteer providers who donate their time and effort to see patients. These providers typically volunteer several days a month, and Grace has formed relationships with them so that the time donated is consistent and routine. This unique way of providing patient care made satisfying element 1A, access during office hours, challenging, but Grace demonstrated that it monitors patient access through same-day appointment availability and timely responses to patients by phone. Despite its limited resources, Grace invested in and implemented an EHR system within its clinic, which allows it to use evidence-based guidelines to follow up with patients regarding their care needs (eg, element 2D, use data for population management). Grace demonstrated the ability to monitor gaps in patient care needs by service care type and to develop a follow-up reminder process to contact patients and schedule them for appointments. The uninsured patients at Grace often present with complex chronic conditions, likely as a result of not having access to proper medical care for long periods of time. Therefore, it was important for these patients that Grace satisfied element 3C, care management, by collaborating with the patients and their families regarding the development of the care plan for the patient. Satisfying element 4A, support self-care process, implies that Grace equips its patients with resources and education to help patients and their families manage patient conditions. Grace also faced a challenge in providing specialist care for its uninsured patients and had to work to develop a network of community specialists who would evaluate and treat these patients. Grace developed a Care Coordination Department that managed all referrals to these community specialists and made sure that the specialists had all of the information necessary to provide care for the patients, thereby satisfying the PCMH requirements of element 5B, referral tracking and follow-up. Finally, Grace’s overall PCMH transformation demonstrates completion of PCMH element 6C, implement continuous quality improvement, in that it established goals based on its performance measures for care delivery and patient experience on an ongoing basis. Grace continues to work to improve performance on these important clinical and patient experience measures.

Grace faced challenges with the must-pass elements and some of the additional requirements that are needed to achieve PCMH recognition due to its clinic model and the patient population it serves. Working in collaboration with the REC, Grace put forth the effort to refine its processes, develop policies, and implement best practices that would demonstrate how its unique model of care could be highlighted to support PCMH recognition.

To achieve PCMH transformation and earn NCQA recognition, senior leaders must first engage staff by making PCMH transformation a key goal for the practice. Leadership buy-in is essential to the successful adoption of the transition. Like any form of innovation, it is more likely to be successful when influential peers become adopters, encouraging others to buy into the transition.

 Engaged leaders make the case for the need to improve the current state of disjointed care, articulate a vision for a better future, and set the tone for change. They identify and mentor champions, use data to drive and guide improvement, and ensure adequate time and resources for the work of transformation.

To drive the transformation, the leaders at Grace created a PCMH taskforce consisting of the executive director, founder/pediatric medical director, adult medical director, clinical manager, a pediatric nurse, and the REC PCMH team. These leaders, working closely with the REC team, formed a strategy for implementation of the PCMH standards that focused on sustainable change. The full engagement among leaders resulted in the adoption of a clinic&shy;wide PCMH culture. The staff and leadership devoted more time to the PCMH project weekly meetings, setting the foundation for successful transformation.

Once the leaders at Grace were fully engaged in the concept of change, they worked closely with the REC team to engage the clinic’s staff. This was accomplished through training on PCMH transformation concepts and regular communication about the status of the project at weekly staff meetings. These meetings engaged staff members in the process of transformation and allowed them to provide feedback on the implemented changes. Additionally, leaders set project and staff goals and expectations, allowing for a culture of accountability to be instilled.

True leadership means you have achieved buy-in from those you lead. Demonstrating to the staff how transitioning to a PCMH would positively impact their roles and the lives of their patients was essential for leadership to create that buy-in. The REC PCMH team helped accomplish this by providing staff training on the concepts and benefits of PCMH transformation and a forum for staff to ask questions and voice their concerns regarding the implementation. Resistance to change is to be expected, but providing staff with an external expert resource to express their concerns further validated Grace’s commitment to its staff. This engagement was also important, as it had a direct impact on the PCMH requirement to measure the patient and family experience.

To prepare for PCMH transformation, medical practices must establish a culture of change that embraces continuous quality improvement (QI). Effective implementation strategies must be established so the staff may carry out a successful transition. Additionally, it is crucial that staff members are educated on the benefits that continuous QI will have on patient outcomes and the clinic’s performance. This QI culture is built using a defined scope, leadership support, proven QI methods, shared ideas, and lessons learned.

QI efforts are proven drivers for improving care delivery and associated outcomes.

They are methodical actions that lead to measurable improvement.

 In order for the PCMH model of care to be implemented, engaged leaders must lay the foundation and organize a QI strategy. At Grace, this strategy built trust among the staff, mentored them, and aligned them with the vision and purpose of the transition. Grace developed a QI team whose responsibilities included setting quality measure goals, reporting QI performance measures to senior leadership, and implementing activities to increase performance. All of Grace’s QI work was guided by the PDSA QI methodology, which was developed and supported by the REC PCMH team through structured training on the PDSA model and ongoing QI support.

To increase stakeholder engagement during the PCMH transition, Grace used patient information and communication tools for engaging patients, their families, and community organizations. Grace achieved this goal through brochures, the Grace website, and structured face-to-face discussions. This transparency encouraged support from community organizations and educated stakeholders on how PCMH transformation benefits both the patient and community. Ensuring that Grace has an effective learning community through a cooperative and respectful culture will determine its success.

The next step to patient engagement is integrating patients into advisory councils to get them more involved. This aligns with the PCMH requirement to incorporate patients into the quality improvement efforts. This includes patients in the decision-making process and creates an overall better experience. Patients who are more engaged have better outcomes.

 Gaining support from all stakeholders, including patients, was critical for Grace to have a successful PCMH implementation, and a key benefit of PCMH adoption is its value to healthcare stakeholders.

The goal of a PCMH is to deliver care and coordinate services that focus on the patient’s needs and preferences. In practice, it has been documented that patients receive better care and experience better outcomes in a PCMH delivery model compared with traditional fee-for-service clinics.

 The community also receives better value for its healthcare dollars because, in most cases, payers achieve savings when using the PCMH model of care. In addition, educational information on how PCMHs improve quality of care, provide a better all-around healthcare experience, and save money helps increase engagement.

Grace has made a substantial and lasting impact on the central Florida community. In the 4 years since transitioning to a PCMH, Grace has had 11,193 patient encounters and enrolled 3073 patients from the community. The practice has avoided more than $1.1 million in hospital expenses, reducing costs for both the hospitals and patients. Grace operates with 19 paid staff members and 393 volunteers, who have given approximately 15,385 volunteer hours. The total value of prescription medications dispensed to patients is $2,564,742.

Grace’s transformation to the PCMH model suggests that: (1) leadership commitment is essential for successful culture change, (2) transformation may be achieved with limited staff, and (3) community organizations may have a role in transformation process. The priority setting from Grace’s leadership demonstrates that PCMH adoption must have support from senior leaders throughout the entire transformation process for sustainable culture change. The volunteer-based staff of Grace demonstrates that the care team may be supported through innovative staffing strategies. Also, educating community stakeholders on issues that may be addressed through PCMH investment may yield higher returns for practice support.

Despite the resource constraints and initial lack of staff engagement, transitioning a nontraditional clinic into a PCMH is possible. For a seamless transition, the leadership team must lay the foundation by being completely engaged with the process.

 Practice leaders must articulate the vision and establish an atmosphere for change to engage the care team and practice staff. Securing staff buy-in is vital to the success of the transition. Efforts to involve other stakeholders in the transformation through engagement and education outlets will provide the necessary support. Patient-centered interactions assisted Grace in demonstrating its improved care delivery.

 Due to these efforts, as of August 2017, Grace received 2014 PCMH recognition, was able to go up a level to level 3, and received 93 of 100 possible points. Grace’s staff and volunteers are enthusiastic to see the outcomes associated with this achievement.

Grace Medical Home’s PCMH designation distinguished the center as one of the first low-cost clinics nationally to achieve such recognition. “Patient care at Grace has always been our first priority,” said founder Hardy. “We are humbled and honored to receive recognition that reaffirms that. We believe that the low-&#8203;income and underserved [population] deserve nothing less than the highest level of medical care.”

 Today, Grace continues to function as a recognized medical home and achieved PCMH 2014 level 3 recognition in August 2017. The organization fills a key healthcare services gap in a community with a 20% uninsurance rate, which is slightly higher than the state average of 18%.

HealthARCH, University of Central Florida College of Medicine (JA, JS, SL), Orlando, FL; Department of Health Management and Informatics, University of Central Florida (MHG, KC-W, KN), Orlando, FL; Florida Hospital (LT), Orlando, FL; National Committee for Quality Assurance (VP), Washington, DC.

 Mr Alexander, Mr Schagrin, and Mr Langdon report consultancy for and employment with HealthARCH, which provides PCMH consulting services. The remaining authors report no relationship or financial interest with any entity that would pose a conflict of interest with the subject matter of this article.

Concept and design (MHG, KC-W, VP); acquisition of data (JS); analysis and interpretation of data (JS, LT); drafting of the manuscript (JA, JS, SL, MHG, KC-W, KN, LT, VP); critical revision of the manuscript for important intellectual content (JA, JS, SL, MHG, KC-W, KN); statistical analysis (KN); provision of study materials or patients (JA, JS); administrative, technical, or logistic support (JS, SL, MHG, KN, LT); and supervision (JS, MHG, KC-W, KN).

Meghan Hufstader Gabriel, PhD, University of Central Florida, 4364 Scorpius St, HPAII-213, Orlando, FL 32816. Email: Meghan.Gabriel@ucf.edu.

1. Patient-Centered Primary Care Collaborative. 

Joint Principles of the Patient-Centered Medical Home

. Washington, DC: Patient-Centered Primary Care Collaborative; 2007.  aafp.org/dam/AAFP/documents/practice_management/pcmh/initiatives/PCMHJoint.pdf.

2. DeVries A, Li CH, Sridhar G, Hummel JR, Breidbart S, Barron JJ. Impact of medical homes on quality, healthcare utilization, and costs. 

3. Berwick DM, Nolan TW, Whittington J. The triple aim: care, health, and cost. 

. 2008;27(3):759-769. doi: 10.1377/hlthaff.27.3.759.

4. Jaén CR, Ferrer RL, Miller WL, et al. Patient outcomes at 26 months in the patient-centered medical home National Demonstration Project [erratum in 

. 2010;8(4):369. doi: 10.1370/afm.1158]. 

. 2010;8(suppl 1):S57-S67; S92. doi: 10.1370/afm.1121.

5. Goldberg DG, Beeson T, Kuzel AJ, Love LE, Carver MC. Team-based care: a critical element of primary care practice transformation. 

. 2013;16(3):150-156. doi: 10.1089/pop.2012.0059.

6. Riddle MC, Lin J, Steinman JB, et al. Incorporating the principles of the patient-centered medical home into a student-run free clinic. 

. 2014;5:289-297. doi: 10.2147/AMEP.S66762.

7. Platonova ER, Warren-Findlow J, Saunders WJ, Hutchison JA, Coffman MJ. Hispanics’ satisfaction with free clinic providers: an analysis of patient-centered medical home characteristics. 

. 2016;41(6):1290-1297. doi: 10.1007/s10900-016-0218-2.

8. Quinn MT, Gunter KE, Nocon RS. Undergoing transformation to the patient centered medical home in safety net health centers: perspectives from the front lines. 

9. Clancy GP, Duffy FD. Going “all in” to transform the Tulsa community’s health and health care workforce. 

. 2013;88(12):1844-1848. doi: 10.1097/ACM.0000000000000039.

10. Patient-centered medical home recognition. National Committee for Quality Assurance website. ncqa.org/programs/recognition/practices/patient-centered-medical-home-pcmh. Accessed July 26, 2017.

11. QuickFacts: Orange County, Florida. United States Census Bureau website. census.gov/quickfacts/fact/table/orangecountyflorida/PST045216. Updated July 1, 2016. Accessed July 25, 2017.

12. PCMH 2011 crosswalk. National Committee for Quality Assurance website. ncqa.org/programs/recognition/practices/patient-centered-medical-home-pcmh/pcmh-archive. Accessed July 26, 2017.

13. Gold MR, McLaughlin CG, Devers KJ, Berenson RA, Bovbjerg RR. Obtaining providers’ ‘buy-in’ and establishing effective means of information exchange will be critical to HITECH’s success. 

. 2012;31(3):514-526. doi: 10.1377/hlthaff.2011.0753.

14. Engaged leadership strategies for guiding PCMH transformation. Safety Net Medical Home Initiative website. safetynetmedicalhome.org/sites/default/files/Implementation-Guide-Engaged-Leadership.pdf. Published May 2013. Accessed January 26, 2016.

15. Johnson KE, Coleman K, Phillips KE, et al. Development of a facilitation curriculum to support primary care transformation: the “Coach Medical Home” curriculum. 

Despite many barriers, Grace Medical Home, a free clinic, achieved patient-centered medical home recognition in October 2014 through a focused team-based approach.

Amazing Grace: A Free Clinic's Transformation to the Patient-Centered Medical Home Model

 The objectives of this study were to describe the locations in hospitals where data are breached, the types of breaches that occur most often at hospitals, and hospital characteristics, including health information technology (IT) sophistication and biometric security capabilities, that may be predicting factors of large data breaches that affect 500 or more patients.

The Office of Civil Rights breach data from healthcare providers regarding breaches that affected 500 or more individuals from 2009 to 2016 were linked with hospital characteristics from the Health Information Management Systems Society and the American Hospital Association Health IT Supplement databases.

 Descriptive statistics were used to characterize hospitals with and without breaches, data breach type, and location/mode of data breaches in hospitals. Multivariate logistic regression analysis explored hospital characteristics that were predicting factors of a data breach affecting at least 500 patients, including area characteristics, region, health system membership, size, type, biometric security use, health IT sophistication, and ownership.

Of all types of healthcare providers, hospitals accounted for approximately one-third of all data breaches and hospital breaches affected the largest number of individuals. Paper and films were the most frequent location of breached data, occurring in 65 hospitals during the study period, whereas network servers were the least common location but their breaches affected the most patients overall. Adjusted multivariate results showed significant associations among data breach occurrences and some hospital characteristics, including type and size, but not others, including health IT sophistication or biometric use for security.

Hospitals should conduct routine audits to allow them to see their vulnerabilities before a breach occurs. Additionally, information security systems should be implemented concurrently with health information technologies. Improving access control and prioritizing patient privacy will be important steps in minimizing future breaches.

Even with sophisticated health information technology (IT) systems in place, security breaches continue to affect hundreds of hospitals and compromise thousands of patients’ data; this gives cause to believe that other hospital factors, such as area characteristics, region, bed size, health system membership, hospital type, hospital governance, and market concentration, may play a vital role in breach risk.

This study's results showed that of all types of healthcare providers, hospitals accounted for approximately one-third of all data breaches and hospital breaches affected the largest number of individuals.

Paper and films were the most frequent mode or location of data breaches. However, although network servers were among the most infrequent locations of data breaches, breaches of this type impacted the most patients overall.

Adjusted multivariate results showed significant associations among data breach occurrences and some hospital characteristics, including type and size, but not others, including health IT sophistication or biometric use for security.

Instances in which private information has been breached are becoming more commonplace in the United States,

 making the security of this type of information a significant concern.

 Healthcare information is particularly vulnerable, due to the sensitivity of these data and how they can be used by criminals.

 Demographic data, Social Security numbers, and clinical information, including medical diagnoses, are housed in both paper and electronic health records (EHRs).

 For these reasons, multiple attempts have been made through federal legislation to help curtail the occurrences of healthcare privacy breaches, including the 1996 Health Insurance Portability and Accountability Act (HIPAA), the Health Information Technology for Economic and Clinical Health Act of 2009, and the Omnibus Final Rule in 2013.

 Despite these initiatives, however, large data breaches are still occurring in US hospitals.

The adoption of EHRs among hospitals has increased rapidly over the past several years.

 As healthcare systems digitized to keep up, the healthcare sector was unable to adopt electronic security components at the same pace, leading to vulnerabilities in record systems.

 In some cases, technology purposed to assist healthcare delivery processes are now having costly difficulties.

 The majority of small- and medium-size health organizations do not possess the financial or personnel resources necessary for sufficient information technology (IT) and security investments.

 This, along with their highly valuable data, has left hospitals vulnerable to breaches of sensitive information.

Hospitals have begun to implement strategies to help prevent data breaches that most often occur through theft, loss, unauthorized access, or hacking.

 Strategies include the adoption of systems that include 2-factor authentication requirements to ensure that patients’ health information is only accessible to and usable by those with rights to access it.

Despite the high level of hospital adoption of electronic health records and the federal incentives to do so, the most common type of data breach in hospitals occurred with paper records and films.

Kendall Cortelyou-Ward, PhD

Articles

To Report or Not Report Health Care Data Breaches

Amazing Grace: A Free Clinic's Transformation to the Patient-Centered Medical Home Model

Data Breach Locations, Types, and Associated Characteristics Among US Hospitals