OCR: “Small” HIPAA Breach Investigations Set to Increase


On August 18, 2016, the Office for Civil Rights (OCR) announced that, while it intends to continue to investigate all instances of reported breaches of protected health information (PHI) involving 500 or more individuals, it will more widely investigate smaller PHI breaches.

OCR explains that its regional offices will increase efforts to identify noncompliance related to “small” breaches and to obtain corrective action to address such noncompliance. Regional offices have discretion over which “small” breaches to investigate, but OCR lists factors that will impact this decision, including whether the covered entity or business associate reports numerous breaches involving similar issues; the type of breach; the amount, nature and sensitivity of the PHI involved; and the size of the breach.

Interestingly, OCR also states that its regional offices may consider the lack of breach reports impacting less than 500 individuals for one covered entity or business associate when compared with similarly situated covered entities or business associates. This implies that it is not only breach reports that may trigger an investigation, but, likely for large systems or organizations, the lack thereof as compared to peer entities.

Two examples OCR gives of “small” HIPAA breaches that were investigated and that resulted in settlements are St. Elizabeth’s Medical Center and QCA Health Plan, Inc. Further information about St. Elizabeth’s settlement can be found here and information regarding QCA’s settlement can be found here.

Valerie Breslin Montague is partner at Nixon Peabody, where she represents a variety of health care providers, digital health vendors, senior living facilities, nonprofit trade associations, life sciences companies and vendors of health care providers. Read more Nixon Peabody blogs here.


Nixon Peabody

At Nixon Peabody, we see 21st century law as a tool to help shape our clients’ futures. We are constantly thinking about what is important to our clients now and next so we can foresee obstacles and opportunities in their space and smooth the way. We work together to handle complex challenges in litigation, real estate, corporate law, intellectual property, and finance anywhere in the world.