To provide healthcare organizations guidance on how to comply with the HIPAA Breach Notification Rule, and the breach notification deadline are discussed below.
What Is Considered a Breach Under HIPAA?
Under HIPAA, a breach is an incident that has the potential to compromise protected health information (PHI). This includes hacking incidents, unauthorized access to PHI (whether it be an outside party, or a member of your workforce accessing PHI without cause), theft or loss of an unencrypted device with access to PHI, or improper disposal of medical records.
Are There Breaches That Need to Be Reported Before February 29th?
The breach notification deadline only applies to breaches affecting less than 500 patients. Larger breaches, affecting 500 or more patients, must be reported no later than 60 days after discovery.