Skip to main content

HITECH Data Breach Reporting Deadline Approaches

Written by Dianne Bourque and Daria Niewenhous

It’s time for mandatory data breach reporting to the Office of Civil Rights (“OCR”) under The Health Information Technology for Economic and Clinical Health Act (“HITECH”) and the interim/final breach notification rules.  Yes, it’s February - time for Valentines, cold and snow (in the Northeast anyway), but most importantly, HITECH requires regulated entities (“covered entities”) to report smaller-scale data breaches (those affecting fewer than 500 individuals) to OCR.  These breach reports are due within 60 days following the end of the calendar year in which the breach occurred.   So, covered entities that experienced a breach or breaches involving fewer than 500 individuals in 2011 should make any required reports to OCR by the end of February.  If you are a covered entity with HITECH reporting obligations, the following resources may be helpful: 

*Instructions for notifying OCR of breaches affecting fewer than 500 individuals; and

*Form for submitting notice to OCR.

Even if you did not experience a reportable breach, it is helpful to review the notification form and to become familiar with the type of information that must be gathered and reported in the event of a data breach.  If you have questions about your reporting obligations, the reporting process or HIPAA compliance in general, contact Dianne Bourque, Daria Niewenhous, or the Mintz Levin attorney who generally assists you.

Subscribe To Viewpoints


M. Daria Niewenhous is a Mintz Member with a well-established health care practice. National and local providers rely on Daria’s experience to navigate capital projects, mergers & acquisitions, integration, and other strategic initiatives; adverse events; and licensing, contracting, patient care/risk management, and other complex legal matters.
Dianne J. Bourque advises health care clients on licensure, regulatory, contractual, risk management, and patient care matters for Mintz. Dianne counsels researchers and research sponsors on FDA and OHRP regulations. She also counsels clients on data privacy issues, including HIPAA standards.