HHS Set to Identify by Name All Private Practices Experiencing a Breach Affecting 500 or More Individuals

more+
less-

As you know, HIPAA covered entities experiencing a security breach are obligated to notify affected individuals, the Department of Health and Human Services (HHS) and, in some cases, the media. When a breach affects 500 or more individuals, the covered entity must report the incident to HHS within 60 days of discovery. HHS, in turn, provides a brief summary of the event on its website.

To date, HHS has listed private practices anonymously, identifying them only as “Private Practice.” HHS took the position that private practices could not be specifically named on the website because they are identifiable as “individuals” within the meaning of the Privacy Act which would potentially require the practice’s consent prior to listing them by name. Pursuant to the Privacy Act, HHS may designate its publication of breaches, including naming private practices, as a “routine use” of the information such that prior consent is not required for the publication. Accordingly, on April 13, HHS published a Federal Register notice stating its intention to start identifying private practices by name on its breach website, designating such publication as a “routine use” of the information under the Privacy Act. HealthLeaders Media reports that HHS will begin naming private practices both prospectively and retroactively within 40 days of publishing the Federal Register notice, or May 23 at the earliest.

Please see full article below for more information.

LOADING PDF: If there are any problems, click here to download the file.


DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Poyner Spruill LLP | Attorney Advertising

Written by:

more+
less-

Poyner Spruill LLP on:

JD Supra Readers' Choice 2016 Awards
Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:

Sign up to create your digest using LinkedIn*

*By using the service, you signify your acceptance of JD Supra's Privacy Policy.

Already signed up? Log in here

*With LinkedIn, you don't need to create a separate login to manage your free JD Supra account, and we can make suggestions based on your needs and interests. We will not post anything on LinkedIn in your name. Or, sign up using your email address.
×
Loading...
×
×