| | |

HHS Office for Civil Rights Delivers Annual Reports to Congress on HIPAA Compliance and Breaches of Unsecured Protected Health Information

The HHS Office of Civil Rights (OCR) provided Congress with two reports for 2021 regarding HIPAA Privacy, Security, and Breach Notification Rule Compliance and Breaches of Unsecured Protected Health Information. These reports can help organizations like pregnancy centers and business associates better comply with the requirements of HIPAA by giving insight to trends in the HIPAA environment.

HIPAA reports

The reports also described steps taken by the OCR to investigate complaints, breach reports, and compliance reviews regarding potential violations of the HIPAA Rules.

“The Annual Report to Congress on Breaches of Unsecured Protected Health Information identifies the number and nature of breaches of unsecured protected health information (PHI) that were reported to the Secretary of HHS during calendar year 2021 and the actions taken in response to those breaches.  It also highlights the continued need for regulated entities to improve compliance with the HIPAA Security Rule requirements, including:

  • risk analysis and risk management;
  • information system activity review;
  • audit controls; and
  • access controls.

These compliance concerns were identified as areas needing improvement in 2021 OCR breach investigations. As it was the previous three years, hacking/IT incidents remain the largest category of breaches occurring in 2021 affecting 500 or more individuals, and affected the most individuals, comprising 75% of the reported breaches.  Network servers is the largest category by location for breaches involving 500 or more individuals.”

OCR’s 2021 Report to Congress on HIPAA Privacy, Security, and Breach Notification Rule Compliance may be found here.

OCR’s 2021 Report to Congress on Breaches of Unsecured Protected Health Information may be found here.

Leave a Reply