On September 29, 2015, the U.S. Department of Health and Human Services Office of the Inspector General (OIG), Office of Evaluation and Inspections, released two studies calling on the HHS Office for Civil Rights (OCR) to strengthen its efforts in both general enforcement of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Standards and enforcement of security breach reporting requirements. OIG commissioned both studies out of concern for the increased risk of an invasion of privacy and exposure to fraud, identity theft and other harm that patients face in an ever-expanding digital health environment.
The Office for Civil Rights of the U.S. Department of Health and Human Services published final modifications to the privacy, security and breach notification standards under HIPAA and the HITECH Act, which require covered entities and business associates to update their policies, procedures, agreements, security measures and operations to comply with new restrictions and requirements, and to benefit from new flexibility.