Health Law

Missing from The Parade of Large PHI Security Breaches - Reasonably Prompt Posting by the Secretary of HHS on the HHS Website

By Michael Kline

As reported previously on this blog, the requirements under the HITECH statutes and regulations for public disclosure of security breaches of Protected Health Information ('PHI') have continuously been bringing to light new breaches of PHI involving highly respected and sophisticated providers and insurers. A recent entry posted on this blog pointed out that the HITECH Act at Section 13402 requires providers and insurers to notify, among others,  the Secretary, currently Kathleen Sibelius (the 'Secretary'), of the U.S. Department of Health and Human Services ('HHS'), respecting a PHI breach involving 500 or more individuals. The notification to the Secretary is required to be made 'without unreasonable delay and in no case later than 60 calendar days after the discovery of the breach of PHI. . . .'

What is supposed to happen, however, when the Secretary receives the report of a PHI breach involving 500 or more individuals? The HIPAA Survival Guide Website quotes Section 13402(e)(4) of HITECH as follows:

(4) Posting on HHS Public Website.—The Secretary shall make available to the public on the Internet website of the Department of Health and Human Services a list that identifies each covered entity involved in a breach . . . in which the unsecured protected health information of more than 500 individuals is acquired or disclosed.

Unfortunately, the HHS Website on Breaches Affecting 500 or More Individuals, which is one of the several statutorily-mandated vehicles for notifying the public and affected individuals of large breaches of PHI security, has no time limits on compliance by the Secretary in posting breaches. I have been regularly visiting the HHS Website since my blog entry on June 28, 2010 that discussed letters sent to 230,000 Anthem Blue Cross subscribers informing them that their personal information might have been accessed during a security breach of the Anthem website. 

There has been no update by HHS of its Website since that time. The most recent posting continues to be the reported June 11, 2010 theft involving the network server of the Nevada University Health System. Meanwhile, there have been many breaches of PHI security widely reported in the media and by affected covered entities. The following are a few of those reported:

June 28, 2010 – 230,000 customers of Anthem Blue Cross

June 30, 2010 – 470,000 customers of Wellpoint, Inc.

July 30, 2010 – 21,000 patients of Thomas Jefferson University Hospital

August 18, 2010 – 1,000 patients of Yale School of Medicine

August 19, 2010 – 10,174 applicants at the University of Connecticut

In light of the sophistication and publicized releases of each of the providers and insurers listed above, it strains the limits of credibility that none of them would have notified the Secretary of the PHI security breaches on a timely basis as required by HITECH. Yet the HHS Website is still silent about each of these large and highly publicized breaches. It would seem reasonable for the Secretary to post the breach items within 60 calendar days as well.

If the Secretary is serious about promoting compliance by covered entities and business associates with their obligations in the event of large PHI security breaches, HHS must lead by example and reasonably comply on a timely basis with its own statutorily-mandated HITECH responsibilities.

Full post as published by HIPAA Health Law & Technology on October 22, 2010 (boomark / email).