32 Large Patient Data Breaches Since September, Says OCR
OCR posted on its Web site a list of covered entities this week that have reported breaches of unsecured PHI affecting more than 500 individuals, fulfilling its obligation under HITECH.
The HHS organization, which oversees enforcement and compliance of the HIPAA privacy and security rules, reports that since September 22, 2009, 32 covered entities have reported breaches that affected at least 500 individuals.
In the cases where a business associate (BA) is involved, OCR lists those organizations as well. OCR reports that among the 32 breaches of 500 or more, seven included BAs. OCR cited one of the BAs by name -- Rick Lawson of Professional Computer Services. That reported breach, in Wilmington, NC, involved 2,000 individuals and was the result of a hacker, according to OCR.
The most egregious breach case came from Blue Cross Blue Shield of Tennessee, which affected 500,000 as a result of stolen hard drives, OCR reported on its Web site.
Following Blue Cross Blue Shield is AvMed, Inc., a Gainesville, FL, health plan. That reported breach occurred on December 10, 2009 and affected 359,000 individuals, according to the post on the OCR site. It resulted from a stolen laptop.
HITECH requires OCR to make public any breaches of 500 or more. OCR says on the site it will continue to update the page as it receives new reports of breaches of unsecured PHI.
- Readmissions: No Quick Fix to Costly Hospital Challenge
- How Top-Ranked MA Plans Earn Their Stars
- House Calls Key to Pioneer ACO Success
- How Telehealth Pays Off for Providers, Patients
- Ebola: Health Officials Try to Quell Front Line Fears
- Defensive Medicine Still Prevalent Despite Tort Reform
- 4 Ways to Lower the Cost to Collect from Self-Pay Patients
- 'Overtreatment' Debate Circles Back to Lung Cancer Screening
- How Hospitals Can Become 'Upstreamists'
- 4 Tips for Managing Employed Physicians