The HITECH Act of 2009 requires the publication of breach summaries, which the Department of Health and Human Services’ (DHHS) Office of Civil Rights (OCR) has been doing on its website, which has come to be referred to as the OCR Wall of Shame. Breach summaries are published for all reported breaches affecting 500 or more individuals, regardless of whether the breach was due to the fault of the healthcare organization or its business associate.
This practice is seen by some as unnecessarily punitive as the involved organization is identified and the OCR Wall of Shame posting remains on the website indefinitely. Others argue for a greater disclosure of information as the purpose of publication is to inform the public of data breaches and to provide information about what occurred, but the information currently disclosed currently lacks any detail concerning the nature of the breach or whether a HIPAA violation was found to have occurred.
The current thinking appears to favor a greater disclosure of information, including a finding of whether the breach was the result of a HIPAA violation. Healthcare organizations, or their business associates, that were found to not be at fault would presumably receive some measure of recognition that their compliance efforts were found to be appropriate. Conversely, offending organizations may find themselves publicly identified as a breaching entity.
While potential changes to the OCR Wall of Shame have not been decided upon, it is unlikely that public reporting will be wholly phased out or that the exposure to significant fines, civil lawsuits, and negative press will lessen as a result. The better plan is to review your organization’s level of compliance and address any areas of potential exposure. If you would like to get a better insight into your organization’s current level of exposure to potential HIPAA violations, consider taking advantage of our Free Risk Assessment Tool. Upon completing the assessment, you will be immediately provided with a Compliance Evaluation Report identifying those areas most in need of your attention.