HHS Withdraws Breach Notification Rule | Healthcare Informatics Magazine | Health IT | Information Technology Skip to content Skip to navigation

HHS Withdraws Breach Notification Rule

August 2, 2010
by David Raths
| Reprints

Health data privacy groups are applauding the fact that the Department of Health and Human Services has withdrawn the Final Rule for Breach Notification for Unsecured Protected Health Information for further study.

HHS received lots of public comment about the “harm standard” in its proposed rule, yet the final rule did not reflect those concerns. The harm standard stated that a breach does not occur unless the access, use or disclosure poses “a significant risk of financial, reputational, or other harm to an individual.”

In the event of a breach, the rule required HIPAA-covered entities to perform a risk assessment to determine if the harm standard is met. If they decided that the risk of harm to the individual is not significant, the health providers were not required to tell patients that their health information was breached.

Privacy groups likened that setup to the fox guarding the henhouse.

In announcing it would withdraw the final breach rule to allow for further consideration, HHS said, “This is a complex issue and the Administration is committed to ensuring that individuals’ health information is secured to the extent possible to avoid unauthorized uses and disclosures, and that individuals are appropriately notified when incidents do occur.”

A group called the Coalition for Patient Privacy put out a release congratulating HHS for seeing the flaws in the rule.

“This is a huge step in the right direction,” it said. “Congress, the Coalition for Patient Privacy, and patients everywhere spoke out against the blatant disregard for patients' rights to be notified of all breaches.”

In a reminder of what is at stake, the Philadelphia Inquirer reported July 30 that Thomas Jefferson University Hospital in Philadelphia told 21,000 of its patients that a laptop computer with unencrypted health and personal information was stolen in June. More than 120 breaches have been reported to HHS since last September. Scot Silverstein, M.D., a medical informatics professor at Drexel University, told the Inquirer that “there is almost no excuse for unencrypted data to be sitting on any computer at a hospital or any organization.”



Cerner Files Protest over $62M EHR Contract Awarded to Epic

Cerner Corp. has filed a protest against rival EHR vendor Epic Systems following an “unfair bidding process and a possible conflict of interest” for a recent IT implementation contract awarded by the University of Illinois (UI) medical center.

NewYork-Presbyterian, Walgreens Partner on Telemedicine Initiative

NewYork-Presbyterian and Walgreens are collaborating to bring expanded access to NewYork-Presbyterian’s healthcare through new telemedicine services, the two organizations announced this week.

ONC Releases Patient Demographic Data Quality Framework

The Office of the National Coordinator for Health IT (ONC) developed a framework to help health systems, large practices, health information exchanges and payers to improve their patient demographic data quality.

AMIA, Pew Urge Congress to Ensure ONC has Funding to Implement Cures Provisions

The Pew Charitable Trusts and the American Medical Informatics Association (AMIA) have sent a letter to congressional appropriators urging them to ensure that ONC has adequate funding to implement certain 21st Century Cures Act provisions.

Former Michigan Governor to Serve as Chair of DRIVE Health

Former Michigan Governor John Engler will serve as chair of the DRIVE Health Initiative, a campaign aimed at accelerating the U.S. health system's transition to value-based care.

NJ Medical Group Launches Statewide HIE, OneHealth New Jersey

The Medical Society of New Jersey (MSNJ) recently launched OneHealth New Jersey, a statewide health information exchange (HIE) that is now live.