Healthcare Law Blog

OCR Offers “Lessons Learned” Regarding HIPAA Compliance

Two recent reports issued by the HHS Office for Civil Rights (“OCR”), pursuant to the HITECH Act, reveal some interesting information about HIPAA data breaches. The Annual Report to Congress on Breaches of Unsecured Protection Information (“Breach Report”) and the Annual Report to Congress on HIPAA Privacy, Security, and Breach Notification Rule Compliance (“Compliance Report”) should remind covered entities and their business associates about the many risks associated with HIPAA and the importance of compliance.

The Breach Report describes the types and numbers of reported breaches for a two year period (2011 and 2012) and provides some cumulative data on breaches reported after the breach notification requirements went into effect. During this two year period, the OCR received reports of 458 big HIPAA breaches affecting 500 or more individuals and a staggering 46,899 small HIPAA breaches affecting less than 500 individuals. OCR investigated all of the 458 large HIPAA breaches and investigated a number of the smaller HIPAA breaches.

Interestingly, OCR imposed its first Resolution Agreement for a small breach, which affected 441 individuals, after the theft of an employee laptop at Hospice of North Idaho in December 2012. For the larger breaches, OCR has entered into Resolution Agreements with seven (7) of the covered entities. The Breach Report revealed that:

• Under these agreements, the covered entities have agreed to pay more than $8 million.

• Nearly two (2) million individuals were affected by these breaches;

• Four (4) of these cases involved the theft of laptops or other electronic devices containing unsecured ePHI and the number one cause of security breaches in both years was theft; and,

• In addition to the settlements, OCR has entered into corrective action plans (“CAPs”) that require specific corrective actions on the part of the covered entities.

Breach Report, p. 20

As the Breach Report points out, CAPs can require a variety of corrective actions, including:

• Revising policies and procedures;

• Training or retraining workforce members who handle PHI;

• Conducting and documenting a risk assessment

• Changing passwords;

• Adopting encryption technologies; or,

• Performing a new risk assessment, among other things.

Breach Report, p. 20-24.

Because investigations and the subsequent agreements, settlements, and corrective actions can be costly to finances and reputations, the Breach Report concludes with a “Lessons Learned” section meant to help covered entities avoid some of the more common type of breaches. To read about the “Lessons Learned” section, check back on Thursday.

Services may be performed by others.

This article does not constitute legal advice.