Dec

12

Large-breach reporting club nears 400 mark

By Dom Nicastro

The Office for Civil Rights (OCR), which began posting entities reporting breaches of unsecured protected health information affecting 500 or more individuals 22 months ago, lists 380 entities as of Friday, December 9.

In February 2010, OCR launched the website required by the HITECH Act under breach notification. Since then, OCR has received an average of about 17 reports per month, or more than one every other day.

Six entities are in OCR’s million-plus patient record breach club:

• TRICARE Management Activity (TMA): 4,901,432, lost backup tapes
• Health Net, Inc.: 1,900,000, unknown
• New York City Health & Hospitals Corporation’s North Bronx Healthcare Network: 1,700,000, stolen electronic medical record
• AvMed, Inc.: 1,220,000, stolen laptop
• The Nemours Foundation: 1,055,489, lost backup tapes
• Blue Cross Blue Shield of Tennessee: 1,023,209, stolen hard drives

As for rules governing breach notification requirements, more than 16 months have passed since OCR last gave an update on the interim final rule on breach notification. That rule, published in the Federal Register August 24, 2009, is in effect.

OCR developed a final rule and sent it to the Office of Management and Budget for review May 14, 2010. However, on July 28, 2010, OCR withdrew the final rule from OMB for “further review,” according to a notice published on its website.