HHS withdraws final breach notification rule

The Department of Health and Human Services today withdrew for further consideration its final breach notification rule for unsecured protected health information under the HITECH Act, citing the department's experience to date in administering the interim final rule. "This is a complex issue and the Administration is committed to ensuring that individuals' health information is secured to the extent possible to avoid unauthorized uses and disclosures, and that individuals are appropriately notified when incidents do occur," HHS said in announcing the decision. "We intend to publish a final rule in the Federal Register in the coming months." The agency submitted a final rule to the Office of Management and Budget for review on May 14. An interim final rule was already in effect as of Sept. 23, 2009.