March 1st HIPAA Breach Report Deadline to HHS Approaching

The March 1^st HIPAA breach report deadline is fast approaching.

HIPAA regulation mandates that healthcare providers must report breaches of unsecured protected health information (PHI) to the Department of Health and Human Services (HHS) Office for Civil Rights (OCR). All HIPAA breaches that occurred in 2015 must be reported no later than 60 days from the end of the calendar year.

The rule here applies to covered entities (CEs) such as doctors, insurance companies, and clearinghouses that have had breaches affecting fewer than 500 individuals. This is considered a Minor Breach. Meaningful Breaches–those affecting more than 500 individuals–must be reported within 60 days of the breach itself.

All minor breaches must be reported by this March 1^st deadline.

OCR has a dedicated site that CEs can visit to report these breaches. Below, we’ve included some information about what OCR is looking for regarding reporting HIPAA breaches, and to whom this deadline applies.

Who Needs to Report?

HIPAA regulation defines a CE as any health plan, healthcare clearinghouse, or healthcare provider that transmits “any information in an electronic form in connection with a transaction for which HHS has adopted a standard.” This includes, for the most part, MDs, clinicians, therapists, optometrists, nursing homes, and behavioral health specialists that handle PHI.

If your organization has had a data breach of any size in 2016, and you meet any of the above requirements, you must visit OCR’s site to report it before March 1^st.

What Needs to be Reported and When?

HHS has a few requirements that determine what should be reported and when. Typically, it’s decided by the number of individuals who were affected by a given breach.

• Individuals affected by a breach should be notified within 60 days of the discovery of the breach.
• CEs must document minor breaches of fewer than 500 individuals’ unsecured PHI and report them to HHS annually. This annual report needs to be given to HHS within 60 days of the end of the previous calendar year–this is the deadline that’s approaching on March 1^st.
• CEs must document meaningful breaches of more than 500 individuals’ unsecured PHI and report them to HHS within 60 days of the discovery of the breach. State media outlets need to be notified as well if the breach has affected 500 of more residents of a single state no later than 60 days of the discovery of the breach.

In the aftermath of OCR’s first fine in the history of HIPAA enforcement for improper compliance with the HIPAA Breach Notification Rule, healthcare professionals of all varieties should ensure that they report their minor breaches to OCR by this March 1^st HIPAA breach report deadline.