Home / Insights / Privacy Breach Notification Rules: OCR to Begin Imposing Penalties for Failure to Comply

Insight Privacy Breach Notification Rules: OCR to Begin Imposing Penalties for Failure to Comply

Grace Period Has Expired. As explained in our prior updates, the new HIPAA breach notification regulations require covered entities to notify patients, HHS, and in some cases local media if there is a breach of unsecured protected health information. (45 C.F.R. § 164.400 et seq.) Although the regulations became effective last September, HHS declared that it would not impose penalties for failure to comply with the breach notification rules if the breach was discovered before February 22, 2010. (74 FR 42757) The 6-month grace period has now expired; accordingly, the failure to comply with the new breach notification rules may now expose the covered entity and business associate to dramatically increased penalties imposed by the HITECH Act.

Only Required to Report Certain Breaches. The good news is that the regulations only require covered entities and business associates to report a “breach” if: (1) there is improper access or disclosure of protected health information that violates the HIPAA privacy rules; (2) the breach poses a significant risk of financial, reputational or other harm to the individual; and (3) the breach does not fit within one of several exceptions. Given the potential liability for breaches, covered entities and business associates should take appropriate steps to ensure they understand and comply with the new regulations as well as the old HIPAA privacy and security requirements.

No New Regulations. On an unrelated note, HHS failed to issue anticipated regulations implementing other HITECH Act provisions by the February 18, 2010 deadline, including regulations governing business associates, business associate agreements, and certain patient rights. OCR officials have reportedly stated that HHS will postpone enforcement of certain HITECH Act provisions that were set to take effect on February 18, 2010 until the new regulations have been issued; however, we have not received official word confirming the same. Stay tuned….

If you have questions about these or other legal issues, please contact a member of our Health Law group  or 208.344.6000.

Related Insights

Corporate Transparency Act - Beneficial Ownership Information Reporting Requirement

The Corporate Transparency Act requires certain entities to disclose the beneficial ownership information from people who own or control a company. We're here to help…


Finding Investment Opportunities in the Modern Zoning Code

The Boise City Council unanimously approved a new zoning code, known as the Modern Zoning Code (MZC), that will go into effect on December 1,…


SECURE 2.0 Update

It has been almost six months since “SECURE 2.0” was enacted as part of the Consolidated Appropriations Act, 2023. There has been no shortage of…


Idaho Liquor License Update

During the final days of the 2023 term of the Idaho legislative session, Senate Bill 1120 (“SB1120”) was passed and signed into law. SB1120 makes…