GAO extends survey on HIPAA breach reporting to Feb. 11

The Government Accountability Office today extended to Feb. 11 its survey for HIPAA-covered health care entities and business associates on their experiences complying with the Department of Health and Human Services’ data breach reporting requirements and HHS efforts to improve the data breach reporting process. The AHA assisted GAO in developing the survey, which will inform a future GAO report to Congress on data breach reporting by covered entities, including any challenges reported by covered entities and HHS efforts to address them.

“We are pleased that the GAO was receptive to extending the deadline to afford more time for hospitals and health systems to help inform the work of the GAO,” said John Riggi, AHA national advisor for cybersecurity and risk. “I can’t stress enough, this is an important opportunity for our voices to be heard to help shape the cyber breach investigation and audit process of the HHS Office for Civil Rights and how they respond to and treat victim organizations of cyber breaches — which we ultimately believe should be treated as the victims of crime, not the perpetrators.” 

Please note that GAO will receive only aggregate responses to the survey and will not attribute specific comments to specific individuals and/or organizations in their report. In addition, SurveyMonkey responses are securely stored in accredited data centers that adhere to security and technical best practices. 

For additional information regarding this or other cyber and risk issues, contact Riggi at jriggi@aha.org.