Insurer, OCR Reach $1.5M Settlement for HIPAA Breach
OCR launched its breach notification website required by the HITECH Act under breach notification in February 2010 and through December 2011 had received an average of 17 reports per month. As of March 13, it lists 400 entities reporting breaches of unsecured PHI affecting 500 or more individuals.
In the last two months, the government enforcer has posted about 10 reports per month. Six entities are in OCR's million-plus patient record breach club, including BCBS as the sixth largest breach:
- TRICARE Management Activity (TMA): 4,901,432, lost backup tapes
- Health Net, Inc.: 1,900,000, unknown
- New York City Health & Hospitals Corporation's North Bronx Healthcare Network: 1,700,000, stolen electronic medical record
- AvMed, Inc.: 1,220,000, stolen laptop
- The Nemours Foundation: 1,055,489, lost backup tapes
- Blue Cross Blue Shield of Tennessee: 1,023,209, stolen hard drives
More than 18 months have passed since OCR last gave an update on the interim final rule on breach notification requirements. That rule, published in the Federal Register August 24, 2009, is in effect. OCR developed a final rule and sent it to the Office of Management and Budget for review May 14, 2010.
- Senators Hear How Two-Midnight Rule Harms Patients, Hospitals
- 3 Management Lessons from a Supermarket Debacle
- Medicare Advantage Carriers See 'No Choice' But to Accept Cuts
- Physicians to Appeal 'Docs v. Glocks' Ruling in FL
- IOM Identifies GME Problems, Calls for Finance Changes
- Healthcare Costs Start With What We Eat
- Handshaking Spreads Germs. Get Over It.
- Revenue Cycles Get a Boost from Simple JPEG Files
- Hospitals Likely to Outsource ICD-10 at Launch
- Anatomy of 3 Health System Rebranding Efforts