New regulations requiring healthcare providers, health plans, and other entities covered by the Health Insurance Portability and Accountability Act (HIPAA) to notify individuals when their health information is breached were issued today by the U.S. Department of Health and Human Services (HHS).
These "breach notification" regulations implement provisions of the Health Information Technology for Economic and Clinical Health Act, passed as part of American Recovery and Reinvestment Act of 2009.
The regulations require healthcare providers and other HIPAA covered entities to promptly notify affected individuals of a breach, as well as the HHS Secretary and the media in cases where a breach affects more than 500 individuals. Breaches affecting fewer than 500 individuals will be reported to the HHS Secretary on an annual basis. The regulations also require business associates of covered entities to notify the covered entity of breaches at or by the business associate.
To determine when information is "unsecured" and notification is required, HHS is also issuing an update to its guidance specifying encryption and destruction as the technologies and methodologies that render protected health information unusable, unreadable, or indecipherable to unauthorized individuals. Entities that secure health information as specified by the guidance through encryption or destruction are relieved from having to notify in the event of a breach of such information. This guidance will be updated annually.
The HHS interim final regulations are effective 30 days after publication in the Federal Register and include a 60-day public comment period.
Read the HHS press release.