title: Breach notification and the law.
abstract: The American Medical Association Council on Ethical and Judicial Affairs (CEJA) has written a position paper on physicians' ethical responsibilities in the event that the security of patients' electronic health information has been breached. The report offers compelling ethical and practical justifications for notification requirements and articulates guidelines for clinicians. This commentary addresses a gap in the report. It outlines the new legal duty to disclose security breaches, established by the 2009 HITECH Act, which is only briefly mentioned in the report. The commentary also analyzes the CEJA recommendations in light of the legal mandate and suggests that the guidance would benefit from further clarification.
authors.affiliation: Case Western Reserve University School of Law, Cleveland, Ohio, USA. sxh90@case.edu
authors.forename: Sharona
authors.initials: S
authors.lastname: Hoffman
mesh_terms: D000574:American Medical Association; D003219:Confidentiality / Q000331:legislation & jurisprudence*; D057286:Electronic Health Records / Q000941:ethics / Q000331:legislation & jurisprudence*; D006801:Humans; D010819:Physician's Role; D010817:Physician-Patient Relations / Q000941:ethics; D017410:Practice Guidelines as Topic; D014342:Truth Disclosure / Q000941:ethics; D014481:United States