It’s time for mandatory data breach reporting to the Office of Civil Rights (“OCR”) under The Health Information Technology for Economic and Clinical Health Act (“HITECH”) and the interim/final breach notification rules. Yes, it’s February – time for Valentines, cold and snow (in the Northeast anyway), but most importantly, HITECH requires regulated entities (“covered entities”) to report smaller-scale data breaches (those affecting fewer than 500 individuals) to OCR. These breach reports are due within 60 days following the end of the calendar year in which the breach occurred. So, covered entities that experienced a breach or breaches involving fewer than 500 individuals in 2011 should make any required reports to OCR by the end of February. If you are a covered entity with HITECH reporting obligations, the following resources may be helpful:
*Instructions for notifying OCR of breaches affecting fewer than 500 individuals; and
*Form for submitting notice to OCR.
Even if you did not experience a reportable breach, it is helpful to review the notification form and to become familiar with the type of information that must be gathered and reported in the event of a data breach. If you have questions about your reporting obligations, the reporting process or HIPAA compliance in general, contact Dianne Bourque, Daria Niewenhous, or the Mintz Levin attorney who generally assists you.
Please see full article below.
Firefox recommends the PDF Plugin for Mac OS X for viewing PDF documents in your browser.
We can also show you Legal Updates using the Google Viewer; however, you will need to be logged into Google Docs to view them.
Please choose one of the above to proceed!
LOADING PDF: If there are any problems, click here to download the file.