Every year, we remind our readers that the HIPAA data breach notification regulations require covered entities to notify the Office for Civil Rights (OCR) of any reportable data breaches that involved fewer than 500 individuals and have not already been self-reported within 60 days following the calendar year. That means that covered entities are required to provide notification to the OCR of data breaches under 500 by February 29, 2020. So this deadline is not missed, many covered entities elect to provide notification to the OCR simultaneously with individual notice, no matter how many individuals are involved.

For those covered entities that wait until the end of the year to report smaller data breaches, now is the time to access the OCR website and report those incidents. The OCR self-reporting website can be accessed here.