Covered entities must report any breaches of protected health information discovered during 2013 to the Department of Health and Human Services (HHS) by March 1, 2014. Such notice can be submitted to HHS by visiting http://ocrnotifications.hhs.gov. Even if the breach occurred prior to 2013 but was discovered by the covered entity in 2013, it must still be reported to HHS no later than March 1, 2014. For breaches involving the protected health information of 500 or more people, the covered entity must also provide notice of the breach to every affected individual within 60 days of its discovery.

If you are a covered entity with questions or concerns about HIPAA compliance, DLM Legal’s experienced health care attorneys can help. Contact one of them today at info@dlmlegal.com or 216.635.0002.