HITRUST: HIPAA Breaches Near $1 Billion
Covered entities and business associates reporting breaches of unsecured personal health information (PHI) affecting 500 or more individuals to the Office for Civil Rights (OCR) together could spend nearly $1 billion because of those breaches.
According to a report from the Health Information Trust Alliance (HITRUST), 108 entities submitting the breach reports to OCR since September 23, 2009 could spend up to $834.3 million in total costs to address violations of the Health Insurance Portability and Accountability Act (HIPAA).
HITRUST used the 2009 Ponemon Institute study that found the average cost for a compromised record to be approximately $144 in indirect costs and $60 of direct costs, for a total cost of $204.
OCR's breach notification website list has grown since the HITRUST report, published this month. As of Wednesday, August 11, 130 entities have reported breaches of 500 or more.
Chris Hourihan, manager of development and programs for HITRUST and the author of the report, says organizations err on the side of caution and provide notice to OCR even if a risk analysis may determine no harm done from their breaches.
The breach notification interim final rule includes a "harm threshold" provision that allows entities to get off the hook from reporting breaches if they determine the incident does not pose significant risk of financial, reputational or other harm to the individual.
- Look Beyond Nurse-Patient Ratios
- Reform Puts Vise Grips on Physicians
- Medicare Opt-Out a Viable Physician Strategy
- Hospital Groups Back NQF Report on Patient Sociodemographics
- NPP Demand Rising Under Value-Based Care Models
- Providers Lag as Consumers Set Agenda
- Boston Marathon Bombing Yields Lessons for Hospitals
- The Flourishing Medical Tourism Business in America
- Esther Dyson Launches Population Health Challenge
- Physicians as Economic Powerhouses and Tech Laggards