White Paper

OCR Announces First Fine for Failing to Provide Timely Notice

 
As you know, HIPAA requires Covered Entities to notify affected individuals if there is a breach of their unsecured PHI. Specifically, 45 CFR 165.404(b) requires each affected individual to be notified of the breach "without unreasonable delay and in no case later than 60 calendar days after discovery of a breach."

Presence Health, an integrated healthcare provider in Illinois, discovered that paper surgery scheduling records had gone missing; the surgery schedules contained PHI of 836 individual patients. The records were noted to be missing on October 22, 2013. However, notice was not provided to OCR until January 31, 2014 (101 days after the breach was discovered), and individual patients weren't notified until February 3 (104 days after discovery), and the media was not notified until February 5 (106 days after discovery). Obviously, this caused Presence to miss the "in no case later than 60 days" notification requirement. Presence blamed the tardiness on miscommunication between workforce members.

Download this white paper to continue reading …

Jeffery P. Drummond is a Partner in the health care section of Jackson Walker L.L.P. He represents hospitals, physicians and physician groups, and other health care providers. Mr. Drummond regularly advises clients regarding compliance with health care, pharmaceutical, and tax exemption laws and regulations, including the federal Stark Law and Anti-Kickback Statute. He is a frequent speaker on medical record privacy and security issues, HIPAA, and cybersecurity. Mr. Drummond maintains a blog on HIPAA and other medical records matters since 2002 at ww.hipaablog.blogspot.com.

Faculty

Jeffery P. Drummond

Jeffery P. Drummond

Jackson Walker L.L.P.