In its Annual Report to Congress on Breaches of Unsecured Protective Health Information, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) reports on both large and small breaches of protected health information (PHI), as well as breach-related settlement agreements and audits.  The Office also recommends steps that covered entities should take to reduce the likelihood of breaches, including having thorough risk analysis and risk management plans, encrypting PHI stored on portable electronic devices, and ensuring that employees are properly trained on privacy and security policies.

Breach Incidents.  Between September 23, 2009 (when the breach notification requirements became effective) and December 31, 2012, OCR received 710 reports of breaches involving 500 or more individuals and these breaches affected a total of about 22.5 million individuals.  For 2011 and 2012, OCR received a total of 458 such reports affecting over 14.5 million individuals.  The primary cause of breaches affecting 500 or more individuals from 2009 through 2012 was theft (between 48% and 60% of breach incidents), followed by loss and unauthorized access or disclosure (ranging between 9% and 19% of breach incidents in each year).  Other causes included improper disposal and hacking or IT incidents.

In 2011 and 2012, breaches involving 500 or more individuals occurred primarily at health care providers (63% and 68% of breaches, respectively), followed by breaches at business associates (27% and 25%, respectively), and health plans (10% and 7%, respectively).

In response to these breaches, covered entities took remedial actions that most commonly included revising policies and procedures, improving physical security or adopting encryption technologies, training or retraining workforce members, providing free credit monitoring to customers, and other actions.

OCR also receives notifications of breaches affecting fewer than 500 individuals.  For 2011 and 2012, OCR received nearly 50,000 reports of smaller breaches, of which about 84% were reported by providers, 16% were reported by health plans, and under 1% were reported by healthcare clearinghouses and other entities.  The most common causes of these breaches were unauthorized access or disclosure, unknown causes, theft, and loss.

Resolution Agreements.  For breaches that occurred between 2009 and 2012, OCR had entered into resolution agreements with seven covered entities as of the end of 2013.  Settlement agreements ranged from $50,000 to $1.7 million.

Audit Activity. As with the Privacy and Security Rules, the HITECH Act required that HHS provide for periodic audits to ensure compliance with Breach Notification Rule requirements.  In its audit pilot program, OCR audited 101 entities for breach notification compliance.  Of these, 31 entities had at least one breach-related audit finding or observation in areas such as notification to individuals and timeliness or methods of notification.

Implications for Covered Entities. Based on reported breaches, OCR suggests that covered entities pay particular attention to several areas.  Covered entities should:

  • Ensure that their risk analysis and risk management plans are thorough and that they address possible vulnerabilities regardless of the location or media in which ePHI are stored.
  • Conduct a security evaluation when they face operational changes such as renovations or moves or when upgrading hardware or software.
  • Ensure that PHI stored on portable electronic devices is safeguarded, including through the use of encryption.
  • Have in place clear policies and procedures for proper disposal of PHI, such as ensuring that electronic equipment is wiped before being discarded or transferred.
  • Limit access to areas or workstations where others could access PHI.
  • Ensure that employees are trained on privacy and security policies and procedures.
Tags: Breach Notification, data breach
Print:
Email this postTweet this postLike this postShare this post on LinkedIn
Photo of Anna D. Kraus Anna D. Kraus

Anna Durand Kraus advises on issues relating to the complex array of laws governing the health care industry. Her background as Deputy General Counsel to the U.S. Department of Health and Human Services (“HHS”) gives her broad experience with, and valuable insight into…

Anna Durand Kraus advises on issues relating to the complex array of laws governing the health care industry. Her background as Deputy General Counsel to the U.S. Department of Health and Human Services (“HHS”) gives her broad experience with, and valuable insight into, the programs and issues within the purview of HHS, including Medicare, Medicaid, fraud and abuse, and HIPAA privacy and security. Anna is co-chair of the firm’s Health Care Industry practice group.

Anna regularly advises clients on Medicare reimbursement matters, particularly those arising under Part B and the Part D prescription drug benefit. She also has extensive experience with the Medicaid Drug Rebate program. She assists numerous pharmaceutical and device manufacturers, health care providers, pharmacy benefit managers, and other health care industry stakeholders to navigate the challenges and opportunities presented by the Affordable Care Act.

Anna is a trusted adviser on health information privacy, security and breach notification issues, including those arising under the Health Insurance Portability and Accountability Act (“HIPAA”) and the Health Information Technology for Economic and Clinical Health (“HITECH”) Act. Her background in this area dates back to the issuance of the original HIPAA privacy regulations.

Anna’s clients depend on her to guide them through compliance with the Anti-Kickback statute, the Stark regulations, and other laws preventing fraud and abuse in the health care industry. Her deep knowledge of these laws has made her an important component of the firm’s representation of pharmaceutical companies and health care organizations under federal investigation or facing allegations under the False Claims Act. In addition, clients contemplating acquisitions in the health care sector rely on her to guide due diligence efforts.

Read more about Anna D. KrausEmail
Show more Show less