The Health and Human Services Department published a rule Aug. 19 that requires healthcare providers and health plans to alert patients to unauthorized access of their health information. The regulations apply to physicians and their offices, hospitals, insurance plans and other healthcare organizations covered by the Health Insurance Portability and Accountability Act (HIPAA).

Healthcare providers and other groups covered by HIPAA must promptly notify affected persons of a breach of their protected health data, as well as the HHS secretary and the media in cases where a violation affects more than 500 people. Healthcare groups also must report annually to HHS breaches that affect fewer than 500 people. The regulation also requires that business associates of organizations that are governed by HIPAA inform the covered group of unauthorized use or access of health information.

The rule makes sure that HIPAA-covered healthcare organizations and their business associates are accountable for properly safeguarding unsecured private information in their care, said Robinsue Frohboese, acting director and principal deputy director of HHS’ Office for Civil Rights, which has responsibility for the enforcement of HIPAA privacy and security.

“These protections will be a cornerstone of maintaining consumer trust as we move forward with meaningful use of electronic health records and electronic exchange of health information,” Frohboese said.