The HIPAA Breach Notification Rule

Brad Rostolsky is a proficient healthcare law attorney with a Juris Doctorate from the Duquesne University School of Law and a Master in Public Health from Emory University. A partner at the Reed Smith law firm, Brad Rostolsky is an expert on HIPAA alignment and leads the HIPAA and Health Privacy and Security group at the firm.

HIPAA, representing the Health Insurance Portability & Accountability Act, was enacted in 1996 and included new requirements related to the privacy and protection of protected health information (PHI). One current component of HIPAA is 45 CFR §§ 164.400-414, the HIPAA breach notification rule, which requires organizations that handle PHI to provide notification in the event of a data breach.

A HIPAA data breach is defined as impermissible disclosure of unencrypted PHI. Once a breach occurs, an organization may need to notify several layers of affected parties. These layers include all individuals affected by the data that was disclosed, prominent news and media outlets in the area, and the secretary of the federal Department of Health and Human Services via a web based breach reporting form. For additional information on HIPAA policy, visit www.hhs.gov/hipaa.