Failure To Timely Notify Results In Enforcement Action And Significant Settlement

For the first time, on January 9, 2017, the Department of Health and Human Services, Office for Civil Rights (HHS/OCR) settled a HIPAA enforcement action based on the untimely reporting of a breach of unsecured protected health information (PHI).

When a health care institution is subject to a potential breach of PHI, that entity is required under HIPAA to provide notice within 60 days of discovery of the incident.

According to OCR, on January 31, 2014, it received a breach notification report from Chicago-based Presence Health, indicating that on October 22, 2013, the organization discovered that paper records containing the PHI of 836 individuals were missing from one of its facilities. OCR's investigation revealed that Presence failed to notify − without unreasonable delay and within 60 days of discovering the breach − each of the affected individuals, prominent media outlets and OCR. Although the delay was due to a miscommunication among Presence employees,