The number of entities reporting breaches of unsecured protected health information (PHI) affecting 500 or more individuals has hit the 100 mark and then some.
As of Friday, July 2, the number of entities reporting the egregious breaches to the government’s HIPAA privacy and security enforcer hit 107. The number of entities—listed on the Office for Civil Rights (OCR) breach notification website—has more than tripled since the enforcer first began posting them in February. The list has grown about 15 per month, or an entity every other day.
The list is required by HITECH, the American Recovery and Reinvestment Act of 2009 privacy subpart that includes greater breach notification requirements and more public scrutiny and increased fines for HIPAA violations.
The reporting requirement is included in the interim final rule on breach notification, which became effective on September 23, 2009.
Those regulations require: