February 26, 2010

HIPAA Breach Notification Reports Due to OCR by March 1, 2010

HIPAA covered entities are required to submit reports of certain breaches under the new Breach Notification Rule to the Office for Civil Rights ("OCR") by March 1, 2010.  Breaches occurring during the time period of September 23, 2009, the effective date of the Breach Notification Rule, through December 31, 2009 are required to be reported at this time.  Reports must be submitted electronically through OCR's breach notification web page at:
http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/index.html. 

The Breach Notification Rule requires covered entities to issue notifications of breaches of unsecured protected health information ("PHI") that compromise the security or privacy of the PHI, unless an exception applies.  In such case, covered entities must notify affected individuals, the media (in certain cases), and OCR.  If a breach affects 500 or more individuals, the covered entity must notify OCR without unreasonable delay and in no case later than 60 days following a breach.  If, however, a breach affects fewer than 500 individuals, the covered entity may notify OCR at the time of the breach or on an annual basis.  Annual reports of breaches affecting fewer than 500 individuals are due to OCR no later than 60 days after the end of the calendar year in which the breaches occurred.

As of January 2010, OCR reports receiving 35 reports of breaches affecting 500 or more individuals, resulting in a total of 712,000 breach notifications to individuals.  Most of these breaches involved the loss or theft of laptops or other portable devices containing unsecured PHI.  OCR has posted these reports of large breaches on its breach notification web page.  OCR also reports receiving over 300 reports of smaller breaches, many of which involved faxing or mailing PHI to the wrong fax number or address.

For additional articles on this topic and other HIPAA topics, please see our "Impact Series" at www.hallrender.com/impact.

If you need additional information about this topic, please contact your regular Hall Render attorney or Elizabeth Callahan-Morris at (248) 457-7854 or ecallahan@hallrender.com.