HIPAA Breach Notifications Begin: US Department of Health and Human Services, Office for Civil Rights, Publicly Posts Breach Info Online

Earlier this week, the US Department of Health and Human Services (HHS), which is now charged with enforcing the US healthcare privacy laws known as HIPAA and HITECH, began posting a list of organizations that have notified the HHS about breaches of unsecured health information that affected more than 500 individuals (as required by section 13402(e)(4) of the HITECH Act, which requires the Secretary of the HHS to "post a list of breaches of unsecured protected health information affecting 500 or more individuals.")

The editors of HealthcareInfoSecurity.com (which is an awesome resource, BTW) have a good summary in their article, "Breach Reports: We've Only Just Begun."

You can find the HHS's list of reported breaches here:

HHS: Healthcare Information Breaches Affecting 500 or More Individuals

Causes for these breaches run the gamut from thefts of paper printouts, hacks and misdirected email messages to losses or thefts of laptops and mobile devices (which would seem to be the most common problem from my cursory scan of the list).

If you're interested in HIPAA/HITECH compliance issues and how they impact email security, you should check out the replay of Proofpoint's recent web seminar, "HIPAA and Beyond: Meeting New Healthcare Security Requirements for Email" at:

http://www.proofpoint.com/id/beyondhipaa/index.php.

Some of that same information is covered in whitepaper form in our paper of the same name. You can download that whitepaper here:

Whitepaper: HIPAA and Beyond - An Update on Healthcare Security
Regulations for Email, 2009

Comments

[Nelson from Detox Cleanse]

Something really has to be done legally to stop this kind of thing from happening

[HIPAA Compliance]

Thanks for the resource. I'll have to post this on my blog. After viewing the list it looks like we need to do something about thieves! I thought there would have been more reports, however, no telling how many covered-entities never report a breach or even follow HIPAA requirements for that matter.