Congressmen Want HIPAA Harm Threshold Eliminated

Covered entities and BAs may get off the hook on some breaches with good reason. But at other times the harm threshold may lead them down the wrong road, misjudging or underrating the impact of the breach.

Kate Borten, CISSP, CISM, president of The Marblehead Group in Marblehead, MA, says, "The bad news from a privacy compliance perspective is that while the harm threshold approach requires organizations to perform and document a risk assessment in every instance, introducing the concept of a subjective harm threshold can be seen as a big loophole that some organizations will stretch."

The letter to Sebelius was signed by:

Henry A. Waxman (D-CA)
Chairman
Committee on Energy and Commerce

Charles B. Rangel (D-NY)
Chairman
Committee on Ways and Means

John D. Dingell (D-MI)
Chairman Emeritus
Committee on Energy and Finance

Frank Pallone Jr. (D-NJ)
Chairman
Subcommittee on Health Committee and Energy and Commerce

Pete Fortney Stark (D-CA)
Chairman
Subcommittee on Health
Committee on Ways and Means

Joe Barton (R-TX)
Ranking Member
Committee on Energy and Commerce