Politico May 22, 2024
With David Lim
Driving The Day
WHO GETS THE CHANGE BLAME? Hundreds of providers are lobbying HHS to be exempted from reporting data breaches in the Change Healthcare cyberattack — though one cybersecurity expert says letting them “off the hook” could set a precedent.
Provider groups — including the American Medical Association, the College of Healthcare Information Management Executives and the American Health Information Management Association — wrote to HHS and the Office for Civil Rights earlier this week to request clarity on who is responsible for reporting breaches of personal health information to federal officials and individuals whose data was breached.
Federal law mandates that entities covered under HIPAA report breaches within 60 days of the breach’s discovery.
According...