December 8, 2021

Volume XI, Number 342

Advertisement
Advertisement

December 07, 2021

Subscribe to Latest Legal News and Analysis

December 06, 2021

Subscribe to Latest Legal News and Analysis
Advertisement

HHS Set to Identify by Name All Private Practices Experiencing a Breach Affecting 500 or More Individuals

As you know, HIPAA covered entities experiencing a security breach are obligated to notify affected individuals, the Department of Health and Human Services (HHS) and, in some cases, the media. When a breach affects 500 or more individuals, the covered entity must report the incident to HHS within 60 days of discovery. HHS, in turn, provides a brief summary of the event on its website, www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/postedbreaches.html.

To date, HHS has listed private practices anonymously, identifying them only as “Private Practice.” HHS took the position that private practices could not be specifically named on the website because they are identifiable as “individuals” within the meaning of the Privacy Act which would potentially require the practice’s consent prior to listing them by name. Pursuant to the Privacy Act, HHS may designate its publication of breaches, including naming private practices, as a “routine use” of the information such that prior consent is not required for the publication. Accordingly, on April 13, HHS published a Federal Register notice stating its intention to start identifying private practices by name on its breach website, designating such publication as a “routine use” of the information under the Privacy Act. HealthLeaders Media reports that HHS will begin naming private practices both prospectively and retroactively within 40 days of publishing the Federal Register notice, or May 23 at the earliest.

Private practices (and other HIPAA covered entities) should take steps to mitigate the risk of a security breach. Although a breach can occur in a variety of ways, almost half of the breaches reported on the HHS website were caused by lost or stolen electronic portable devices, such as laptops. In addition, BNA’s Privacy Law Watch reports that 80% of medical identity theft cases are caused by health organizations’ staff. As a result, portable media and dishonest employees are among the most likely causes of a security breach.

HIPAA covered entities also should implement a procedure to respond to suspected breaches, as mandated by recent revisions to the HIPAA Privacy Rule. A sound procedure will help covered entities, including private practices, to respond promptly to suspected breaches, enabling them to meet the 60-day reporting deadline if their investigation of the breach determines it must be notified to individuals and HHS.

© 2021 Poyner Spruill LLP. All rights reserved.National Law Review, Volume , Number 190
Advertisement
Advertisement
Advertisement
Advertisement
Advertisement
Advertisement

About this Author

With change constant, and accelerating, health care organizations encounter ever widening obstacles to their success. They need legal guidance from a law firm that understands the challenges they face and can fashion responses to meet their needs.

At Poyner Spruill, we provide just that.

We work with hospitals and health systems, physicians and other licensed medical professionals, physician and other clinical practices, managed care organizations, provider associations, nursing homes, home health agencies, assisted living facilities, hospice agencies, dialysis centers,...

252.446.2341
Advertisement
Advertisement
Advertisement