Risks and Responsibilities Under HIPAA After an Impermissible Disclosure Occurs

[T]o the extent practical, [covered entities] must do what they can to lessen the harmful effects of any security incident that is known to them and that is in violation of either their policies and procedures or the regulatory requirements of HIPAA more generally.

Since passage of the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191, §§ 261-264 (August 21, 1996) ("HIPAA"), the requirements that health care organizations face regarding the protection of personal health information have steadily increased. As a result, covered entities governed by HIPAA have been faced with a barrage of new requirements for handling patient information. Those requirements have been spelled out in great detail, and enforcement officials have emphasized the existence of civil monetary penalties for wrongful disclosures made knowingly or for malicious or commercially advanta-geous reasons. Less attention has been targeted at the actions that covered entities should take