The deadline for reporting healthcare data breaches of fewer than 500 records that were discovered in 2020 is fast approaching. HIPAA covered entities and business associates have until March 1, 2021 to submit breach reports to the Department of Health and Human Services’ Office for Civil Rights (OCR)that were discovered between January 1, 2020 and December 31, 2020.
HIPAA defines a breach as “an impermissible use or disclosure under the Privacy Rule that compromises the security or privacy of the protected health information. An impermissible use or disclosure of protected health information is presumed to be a breach unless the covered entity or business associate, as applicable, demonstrates that there is a low probability that the protected health information has been compromised.” A risk assessment should be conducted to determine the probability that PHI has been compromised, that must include the nature and extent of PHI involved, the probability of identification of individuals; the person who used/disclosed the PHI; whether PHI was viewed or acquired by an unauthorized individual; and the extent to which risk has been mitigated.
The HIPAA Breach Notification Rule requires notifications to be issued to affected individuals within 60 days of the discovery of a breach. All breaches must be reported OCR , including security incidents and privacy breaches affecting a single patient. If the breach affects 500 or more individuals, OCR must also be notified within 60 days. When there is a smaller breach, patients must still be notified within 60 days, but OCR does not need to be notified until 60 days from the end of the calendar year when the breach was discovered.
Breach reports should be submitted to OCR electronically via the OCR breach reporting portal. While smaller breaches can be reported ‘together’ ahead of the deadline via the portal, each incident must be submitted individually. Since details of the breach must be provided, including contact information, the nature of the incident, and the actions taken following the breach, adding these breach reports can take some time. The best practice is to report the breaches throughout the year when sufficient information about the nature, scope, and cause of the breaches are known, rather than wait until the last minute.
The failure to report small healthcare data breaches before the deadline could result in sanctions and penalties against the covered entity or business associate.
The post March 1, 2021: Deadline for Reporting 2020 Small Healthcare Data Breaches appeared first on HIPAA Journal.