The U.S. Department of Health and Human Services, Office for Civil Rights (OCR) announced that beginning this month, its regional offices will more widely investigate the root causes of breaches affecting fewer than 500 individuals.

OCR announced this new initiative but noted that its offices will still retain discretion to prioritize which small breaches to investigate while still increasing efforts to identify and obtain corrective action. In assessing breaches, OCR regional offices will consider a number of factors, including size of breach; nature, amount, and sensitivity of health information involved; and instances of numerous breach reports with similar issues from a particular entity. OCR will also consider the lack of breach reports affecting fewer than 500 individuals when comparing a specific entity to similarly situated entities.