US Department of Health and Human Services Office for Civil Rights
UShhs.gov
The US Department of Health and Human Services Office for Civil Rights enforces the HIPAA Breach Notification Rule (45 CFR sections 164.400-414): a HIPAA-covered entity must notify affected individuals of a breach of unsecured protected health information without unreasonable delay and no later than 60 calendar days after discovery, and HHS OCR at the same time when 500 or more people are affected; smaller breaches are reported to HHS once a year. Breach Census ingests HHS OCR's published breach portal daily to build incident records; HHS OCR's own enforcement actions (resolution agreements and civil monetary penalties) are not yet a separately collected feed, so this page's actions table stays empty even though HHS OCR-sourced incidents appear on affected organizations' own pages.
Enforcement actions
No enforcement actions recorded for this regulator yet.
Questions and answers
Does Breach Census have any enforcement actions from US Department of Health and Human Services Office for Civil Rights on file?
No enforcement actions from US Department of Health and Human Services Office for Civil Rights are recorded on Breach Census yet.
What is US Department of Health and Human Services Office for Civil Rights's breach-notification rule?
The HIPAA Breach Notification Rule (45 CFR 164.404-164.408) requires notice to affected individuals without unreasonable delay and no later than 60 calendar days after discovery of a breach of unsecured protected health information, and to HHS OCR at the same time when 500 or more people are affected (annually for smaller breaches).