HITRUST: HIPAA Breaches Near $1 Billion
Covered entities and business associates reporting breaches of unsecured personal health information (PHI) affecting 500 or more individuals to the Office for Civil Rights (OCR) together could spend nearly $1 billion because of those breaches.
According to a report from the Health Information Trust Alliance (HITRUST), 108 entities submitting the breach reports to OCR since September 23, 2009 could spend up to $834.3 million in total costs to address violations of the Health Insurance Portability and Accountability Act (HIPAA).
HITRUST used the 2009 Ponemon Institute study that found the average cost for a compromised record to be approximately $144 in indirect costs and $60 of direct costs, for a total cost of $204.
OCR's breach notification website list has grown since the HITRUST report, published this month. As of Wednesday, August 11, 130 entities have reported breaches of 500 or more.
Chris Hourihan, manager of development and programs for HITRUST and the author of the report, says organizations err on the side of caution and provide notice to OCR even if a risk analysis may determine no harm done from their breaches.
The breach notification interim final rule includes a "harm threshold" provision that allows entities to get off the hook from reporting breaches if they determine the incident does not pose significant risk of financial, reputational or other harm to the individual.
- 1 in 5 Eligible Hospitals Penalized for HACs
- 'Mega Boards' Could be Rural Healthcare Disruptor
- Two-Midnight Rule Will Cost Hospitals Big
- The Hospital of the Future is Not a Hospital
- Meaningful Use Payment Adjustments Begin
- PA hospital to pay $662,000 to settle Medicare fraud case
- HL20: Rebecca Katz—Cooking Up Sustainable Nourishment
- Supreme Court to hear Obamacare subsidy challenge in March
- HL20: Peter Semczuk, DDS, MPH—Taking on the Big Challenges
- 12 Hires to Keep Your Hospital Out of Trouble