HIPAA Reports Of 2017 Small-Scale Breaches Due March 1, 2018

Covered entities that discovered small-scale HIPAA breaches during calendar year 2017 must file notice of such breaches with the Office of Civil Rights (OCR) by March 1, 2018.

Under HIPAA rules, covered entities do not have to report breaches impacting less than 500 individuals to OCR concurrently with reporting to affected individuals.1 Rather, the covered entity must maintain a log of small-scale breaches during the calendar year and report the breaches to OCR no more than 60 days after the end of that calendar year.2

Covered entities that waited to report small-scale breaches may submit notice through OCR's website. The reporting requirements to OCR for small-scale HIPAA breaches do not eliminate the duty of the covered entity to notify affected individuals within applicable time frames.3