The Centers for Medicare & Medicaid Services’ (CMS) Office of E-Health Standards and Services (OESS) has decided not to initiate enforcement action until March 31, with respect to HIPAA-covered entities (including health plans, healthcare providers and clearinghouses, as applicable) not compliant with the operating rules adopted for the following transactions as required by the Patient Protection and Affordable Care Act: eligibility for a health plan and healthcare claim status. Notwithstanding OESS’ discretionary application of its enforcement authority, the compliance date for using the operating rules remains Jan. 1.

The Hospice of North Idaho has agreed to pay the U.S. Department of Health and Human Services (HHS) $50,000 to settle potential violations of the HIPAA Security Rule. This is the first settlement involving a breach of unprotected electronic protected health information affecting fewer than 500 individuals.

A stolen laptop is the source of a data breach impacting 29,000 patients of Gibson General Hospital.

More than 1,000 Kentucky Medicaid beneficiaries have been notified that their data may have been compromised as part of a computer scam.

The theft of electronic equipment from a vendor employee's car has prompted the University of Michigan Health System (UMHS) to alert approximately 4,000 patients that some of their demographics and health information may have been exposed.

The Walgreens drugstore chain will pay $16.6 million to settle a California case involving improper disposal of hazardous waste, including confidential patient information, in dumpsters near their stores.

The Department of Health and Human Service’s (HHS) Office for Civil Rights has issued guidance regarding two methods for de-identification of protected health information to assist covered entities understand what de-identification is and how de-identified information is created.

The HITECH Act tasked the Office for Civil Rights within the Department of Health and Human Services with auditing HIPAA-covered entities to ensure personal health information is being protected. Since then, the office has turned its attention to enforcement, according to OCR Director Leon Rodriguez, JD, who spoke Dec. 13 at the Privacy and Security Forum hosted by the Health Information and Management Systems Society and Healthcare IT News.