The Department of Health and Human Services (HHS) Office for Civil Rights (OCR) recently launched the improved Health Insurance Portability and Accountability Act (HIPAA) Breach Reporting Tool (HBRT). The Health Information Technology for Economic and Clinical Health (HITECH) Act required that OCR release the HBRT in 2009. Through this web tool, the public can access the information that HIPAA covered entities must report to OCR when they are involved in breaches of unsecured protected health information affecting 500 or more individuals. Covered entities are also required to promptly notify affected individuals, and/or the media in some cases, of a breach. The HBRT provides the public with the following information: entity name and state; number of individuals affected by the breach; breach date and type (e.g., hacking/IT incident, theft, loss, unauthorized access/disclosure); and the location of the breached information (e.g., laptop, paper records, desktop computer).
OCR stated that the improved HBRT navigation features will empower individuals to easily identify recent health information breaches. Further, the web tool will allow individuals to track how such breaches are investigated and successfully resolved. Additionally, the revised HBRT makes it easier for organizations to report incidents. Organizations can also use the HBRT to learn about the types of breaches that are occurring, within the industry or within particular sectors, and how the OCR commonly resolves breaches following their investigations. With these improved HBRT capabilities, the OCR believes that health care organizations will be better equipped to enhance their security status regarding health information. HHS plans to use the feedback to eventually expand and improve the website over time and add enhanced functionality and features.
New features of the HBRT include:
- Enhanced functionality highlighting breaches currently under OCR investigation and reported within the last 24 months;
- A new archive including previous breaches and information about how those breaches were resolved;
- Improved navigation to gain additional breach information; and
- Tips for consumers.
The OCR HBRT is available at: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf.