List of 36 Major Healthcare Breaches Posted

The breaches were reported from September 2009 through January. They included incidents involving physician group practices, hospitals, state agencies and insurers, among others.

Beginning Feb. 22, the Office for Civil Rights within the U.S. Department of Health and Human Services began posting on its Web site a list of organizations that have notified HHS about a breach of unsecured health information involving more than 500 individuals. Under the HITECH Act's breach notification rule, such incidents must be reported to HHS and the media within 60 days. Smaller breaches must be reported to HHS annually.

The details

The biggest case reported so far, involving more than 500,000 individuals, was thetheft of hard drives from BlueCross BlueShield of Tennessee.

In addition to that incident, some 27 of the other incidents involved thefts of such items as a laptop, computer, CDs or other items.

Other cases included the loss of backup tapes, the loss of a portable electronic device, mailing errors, misdirected e-mail and a hacking incident. In addition, the University of California, San Francisco was the victim of a phishing scam.

Although the rule went into effect last September, the Office for Civil Rights did not begin enforcement, with potential penalties, until Feb. 22.

Annual update

The Office will report to Congress annually the number and nature of breaches reported and actions taken in response to those breaches. That annual report, which will be posted on the Office's Web site, will include breaches of all sizes, officials said.

The deadline for healthcare organizations to provide an annual summary of breaches of all sizes to HHS is March 2.

To view the updates on breaches,click here.