HITECH Act Privacy and Security Final Rules Needed Now

As of October 25, 2011, OCR has reported 345 such breaches involving a total of 11,959,488 individuals. Not reflected yet in the OCR disclosed breaches are two involving 6.5 million individuals: a Nemours breach of 1.6 million individuals and a TRICARE breach involving 4.9 million individuals. OCR has indicated on several occasions this year that the final Omnibus Privacy, Security, Breach Notification, and Enforcement Rules will be published in the Federal Register by the end of 2011. It is time to get the enabling Final Rules published in the Federal Register. Perhaps then, and certainly after expected compliance with the Rules is required in 2012, covered entities and their business associates will sharpen focus on safeguarding protected health information that is created, stored, in motion, or disposed of, thereby lessening the likelihood and consequences of breaches and detection of non-compliance via audits and investigations.