Groups Ask HHS for Guidance on Massive Change Breach Reports

The article discusses the efforts by major healthcare industry groups, including the College of Healthcare Information Management Executives (CHIME) and the American Medical Association (AMA), to urge the U.S. Department of Health and Human Services' Office for Civil Rights (HHS OCR) to provide clear guidance on breach notification responsibilities following a massive data breach at Change Healthcare. This breach impacted millions of patients and disrupted services for healthcare providers. While Change Healthcare has offered to handle the breach notifications, industry groups seek assurances that the regulatory burden will fall on Change Healthcare rather than the affected healthcare providers. Despite HHS OCR’s guidance allowing such delegation, covered entities remain ultimately responsible for ensuring notifications are made, prompting ongoing requests for further clarification.

Opens on bankinfosecurity