Small HIPAA Breaches, Big HIPAA Headaches

What you might have thought was not a big breach (or a big deal in terms of HIPAA compliance), might end up being a big headache for covered entities and business associates. In fact, it's probably a good idea to try to find out what "smaller" breaches your competitors are reporting (admittedly not an easy task, since the "Wall of Shame" only details breaches affecting the protected health information (PHI) of 500 or more individuals).

Subscribers to the U.S. Department of Health and Human Services Office of Civil Rights (OCR) listserv received an announcement a couple of weeks ago that OCR would begin to "More Widely Investigate Breaches Affecting Fewer than 500 Individuals". The announcement states that the OCR Regional Offices investigate all reported breaches involving PHI of 500 or more individuals and, "as resources permit", investigate breaches involving fewer than 500. Then the announcement warns that Regional Offices will increase efforts "to identify and