On August 18, 2011, David A. Mayer, Acting Senior Advisor for Health Information Privacy, Compliance & Enforcement, U.S. Department of Health and Human Services, Office for Civil Rights, gave a presentation to attorneys at a conference sponsored by the Indianapolis Bar Association. Mr. Mayer focused his presentation on providing an update of the Office for Civil Rights’ (OCR) enforcement of the Health Insurance Portability and Accountability Act (HIPAA) privacy and security regulations. 

In discussing the breach notification requirements, Mr. Mayer stated that the deadline for notification must be made without unreasonable delay, but in no case shall notification be made later than sixty calendar days after discovery of the breach. Mr. Mayer emphasized that this does not mean a covered entity has sixty days to notify all individuals of a breach.  Instead, a covered entity must notify all individuals as soon as it confirms a breach has occurred. Mr. Mayer indicated that OCR has investigated instances where a covered entity confirms a breach and obtains all of the information necessary to notify the individuals within just a few days of discovering the breach, but then waits to send the notification until sixty calendar days after discovering the breach. According to Mr. Mayer, such delay in notification violates the regulation.

Mr. Mayer also stated that OCR is required to investigate all reports of breaches involving more than five hundred individuals. He explained that when a covered entity reports such a breach, the covered entity should be prepared to respond to OCR with the following information:

• A determination of the root cause of the breach;
• Identification of the gaps in complying with the Privacy and/or Security rules that led to the breach; and
•  Evidence that the root cause has been addressed to ensure that further breaches do not occur.

Each OCR regional office has discretion whether to investigate breaches involving less than five hundred individuals. Mr. Mayer explained that each regional office monitors a list of such breaches, and a regional office will be more likely to investigate a covered entity if it appears to be involved in multiple breaches, particularly where the breaches are similar in nature. 

Finally, Mr. Mayer noted that OCR is still in the process of finalizing the following HIPAA rules:

•  Breach notification interim final rule, issued August 24, 2009;
•  Enforcement and compliance interim final rule, issued October 30, 2009;
•  Privacy and security provisions proposed rule which makes business associates subject to HIPAA, issued July 14, 2010; and
•  Accounting for disclosures from electronic records proposed rule, issued May 31, 2011.

Mr. Mayer explained that OCR does not yet know when the rules will be finalized, but said that he hopes the rules will be finalized by the end of this year.