Looking for a Business Associate Agreement? Download our FREE starter template.
Total HIPAA Logo

It’s Time to Report Small Breaches – Don’t Miss the Deadline

HIPAA breaches involving less than 500 individuals during the calendar year 2015 must be reported to the U.S. Department of Health and Human Services (HHS) by Monday, February 29th, 2016.

Why Do Small Breaches Need to be Reported?

Every breach involving fewer than 500 individuals must be logged when it happens and reported to HHS within 60-days of the end of the calendar year regardless of how minor the incident or how few individuals are involved. Often things that you may regard as a simple oversight or misunderstanding are actually defined by HIPAA as breaches.

Here are a few examples from the HHS website of small breaches that should be recorded in a breach log and reported at years’ end:

  • A municipal social service agency disclosed PHI while processing Medicaid applications by sending consolidated data to computer vendors that were not Business Associates.
  • A mental health center did not provide a notice of privacy practices to a father or his minor daughter, a patient at the center.
  • A staff member of a medical practice discussed HIV testing procedures with a patient in the waiting room, thereby disclosing PHI to several other individuals.
  • A grocery store based pharmacy chain maintained pseudoephedrine log books containing PHI in a manner so that individual PHI was visible to the public at the pharmacy counter.

You can view the full list of HHS examples here.

Will I Be Penalized for the Breaches that I Report?

No, you will not be penalized. Logging your breaches throughout the year demonstrates to HHS that you are doing your best to comply with HIPAA. You acknowledge when any PHI has potentially been compromised and that you have taken measures to make sure the same breaches do not happen again in the future.

Not logging breaches, however, can carry serious consequences as it is seen as a failure to cooperate by HHS. It is also a requirement for the appropriate employees in your organization to be trained specifically on how to log a breach. Should you receive an audit and your employees cannot demonstrate knowledge of the breach report logging process, you could be penalized.

What if My Business Associate Logged the Breach?

If your Business Associate logged the breach and you have designated them as responsible for reporting the breach, that is fine. However, you will want to review the breach report before they file it to make sure it is correct, and then follow up with them before February 29th to be sure that it has been filed.

Looking ahead

If you have logged breaches in 2015, make sure to report them to HHS by Monday, February 29th. You can begin the reporting process here.

If you didn’t log any breaches last year now is an excellent time to make sure you have a process in place for logging breaches and that your employees are trained on how to use it.

If you need help getting started, contact us today!

Sharing is caring!


Looking for a Business Associate Agreement?

Download our free template to get started on your path toward HIPAA compliance.

Download Now

Let's keep in touch

Stay up to date on the latest HIPAA news, plus receive tons of free tools and info.

Navigating HIPAA Compliance in 2023

Watch the recording of this webinar to learn more about how you can become and stay HIPAA compliant!


Related Posts

What is Access Control in terms of HIPAA?

What is Access Control in terms of HIPAA?

Access control, in terms of cybersecurity, refers to the practice of managing and regulating who can access specific resources, systems, or data within an organization's network or information...

Comparing HIPAA and NIST

Comparing HIPAA and NIST

In the ever-evolving landscape of data security and privacy, two key frameworks have emerged as significant players: HIPAA and NIST. Both emphasize the importance of safeguarding sensitive...

Save & Share Cart
Your Shopping Cart will be saved and you'll be given a link. You, or anyone with the link, can use it to retrieve your Cart at any time.
Back Save & Share Cart
Your Shopping Cart will be saved with Product pictures and information, and Cart Totals. Then send it to yourself, or a friend, with a link to retrieve it at any time.
Your cart email sent successfully :)