Corporate Compliance

Q&A: Notification of compliance breach

Compliance Monitor, October 28, 2009

Want to receive articles like this one in your inbox? Subscribe to Compliance Monitor!

 Q: Is a business associate (BA) that discovers a breach ever responsible for notifying the individual(s) affected, media outlets, or HHS? Or does the BA only have to notify the covered entity (CE)?

 A: The CE has sole responsibility for notifying individuals when required. The CE must notify HHS immediately if a breach involves 500 or more individuals and/or at the end of the calendar year with respect to all breaches, regardless of whether the CE or the BA caused the breach.
 
A review of the breach notification interim final rule, which is final and was published in the Federal Register August 24, is a good idea. Visit www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/breachnotificationifr.html
 
Chris Apgar, CISSP, answered this question in the Octobert 2009 issue of the HCPro newsletter Briefings on HIPAA. For more information about this newsletter visit the HCMarketplace.



Want to receive articles like this one in your inbox? Subscribe to Compliance Monitor!

    Strategies for Health Care Compliance

  • Strategies for Health Care Compliance

    News and real-life examples to increase the effectiveness of your compliance program. Strategies for Health Care Compliance...

  • Compliance Monitor

    This HTML e-mail newsletter delivers news on Medicare and Medicaid fraud and abuse, as well as recent documents and targets...

  • Medicare Weekly Update

    Each issue of Medicare Weekly Update includes the latest CMS proposed and final rules, CMS manual revisions, and...

  • Medicare Update for Physician Services

    Medicare Update for Physician Services is a free, monthly e-zine that delivers news and information to help physician...

Most Popular

Related Articles