• E-mail
• Print
• RSS

Small breaches could become a big problem

Briefings on HIPAA, November 1, 2016

This is an excerpt from a member only article. To read the article in its entirety, please login or subscribe to Briefings on HIPAA.

In a year of high-profile, multimillion dollar settlements for large HIPAA breaches, OCR raised the stakes in a big way?by taking a harder line on small breaches. OCR announced plans to crack down on smaller breaches?those affecting fewer than 500 individuals?in August. Although all breaches must be reported to OCR, generally only breaches affecting 500 or more individuals are regularly investigated, while small breaches are investigated only as resources permit. OCR instructed its regional offices to increase investigations of small breaches to discover the root causes. Identifying common root causes will help the agency better measure HIPAA compliance throughout the industry and address industrywide compliance gaps, OCR said. Regional offices may obtain corrective action if an investigation of a smaller breach reveals noncompliance.

This is an excerpt from a member only article. To read the article in its entirety, please login or subscribe to Briefings on HIPAA.

• E-mail to a Colleague
• Print
• RSS
• Archive