Report Data Breaches On Time Or Pay The Price

The HHS Office of Civil Rights (OCR) recently announced a settlement with Presence Health Network (Illinois) for failing to comply with the Data Breach Notification Rule because it failed to provide notice of a data breach within the required 60 days. Presence discovered on October 22, 2013, that paper-based Operating Room schedules containing PHI for 836 individuals were missing from one of its Ambulatory Surgery Center. Presence took over 100 days to notify affected individuals, the media and HHS of the breach. The explanation for the delay was miscommunication among staff who were responsible for the breach response. However, the OCR investigation revealed that Presence had failed to timely notify individuals of other data breaches in 2015 and 2016 after the 2013 breach indicating that Presence had not corrected its breach response processes. This is the first time that HHS has imposed sanctions on a HIPAA covered entity or business associate for failure to comply