Home / Insights / Privacy Breach Notification Rules: OCR to Begin Imposing Penalties for Failure to Comply

Insight Privacy Breach Notification Rules: OCR to Begin Imposing Penalties for Failure to Comply

Grace Period Has Expired. As explained in our prior updates, the new HIPAA breach notification regulations require covered entities to notify patients, HHS, and in some cases local media if there is a breach of unsecured protected health information. (45 C.F.R. § 164.400 et seq.) Although the regulations became effective last September, HHS declared that it would not impose penalties for failure to comply with the breach notification rules if the breach was discovered before February 22, 2010. (74 FR 42757) The 6-month grace period has now expired; accordingly, the failure to comply with the new breach notification rules may now expose the covered entity and business associate to dramatically increased penalties imposed by the HITECH Act.

Only Required to Report Certain Breaches. The good news is that the regulations only require covered entities and business associates to report a “breach” if: (1) there is improper access or disclosure of protected health information that violates the HIPAA privacy rules; (2) the breach poses a significant risk of financial, reputational or other harm to the individual; and (3) the breach does not fit within one of several exceptions. Given the potential liability for breaches, covered entities and business associates should take appropriate steps to ensure they understand and comply with the new regulations as well as the old HIPAA privacy and security requirements.

No New Regulations. On an unrelated note, HHS failed to issue anticipated regulations implementing other HITECH Act provisions by the February 18, 2010 deadline, including regulations governing business associates, business associate agreements, and certain patient rights. OCR officials have reportedly stated that HHS will postpone enforcement of certain HITECH Act provisions that were set to take effect on February 18, 2010 until the new regulations have been issued; however, we have not received official word confirming the same. Stay tuned….

If you have questions about these or other legal issues, please contact a member of our Health Law group  or 208.344.6000.

Related Insights

The Well-Reasoned Decision: Lessons from the Interfaith Sanctuary Case

In the realm of public decision-making, Idaho government entities must ensure that their decisions are well-reasoned, transparent, and legally sound. A well-reasoned decision not only…

Read

Treasury Department Suspends Enforcement of Corporate Transparency Act

The Treasury Department has indicated it will suspend enforcement of the CTA concerning U.S. citizens and domestic reporting companies.

Read

Corporate Transparency Act Update - Nationwide Preliminary Injunction Lifted Again

The court ordered preliminary injunction that halted enforcement of the Corporate Transparency Act (CTA) nationwide has been lifted again.

Read

Immigration Issues for Employers in 2025 and Beyond

Employers may be facing additional oversight from the new administration, even for those who do not employ foreign workers.

Read