On January 9, 2017, the U.S. Department of Health and Human Services (“HHS”) announced its first enforcement action under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) involving delayed data breach reporting. HHS settled alleged violations of the HIPAA breach notification rule committed by Presence Health, one of the largest health care networks in Illinois. The settlement agreement called for Presence Health to pay $475,000 and to adopt a corrective action plan. This settlement underscores the importance of understanding your organization’s HIPAA policies and procedures, and raises several practical considerations going forward.
First introduced in 2015 and signed into law in June 2016, an amendment to the Massachusetts Public Records Law (M.G.L. c.66) now makes the state’s Office of Consumer Affairs and Business Regulation (OCABR) online Data Breach Notification Archive available to the public.
In response to the uniformly negative feedback it received from industry participants and interested parties, the New York State Department of Financial Services has modified its proposed cyber security regulations and delayed their start date by two months.
HSE Partner and Chair of the Privacy and Data Security practice group, F. Paul Greene, will be speaking at a seminar hosted by EFPR Group LLP titled “Information and Cyber Security Responsibilities for Senior Management,” on December 8, 2016.