The Health Information Technology for Economic and Clinical Health (HITECH) Act, enacted as part of the ARRA, requires covered entities to report to HHS within 60 days of discovery any breaches of protected health information that affect 500 or more individuals. The HHS Office for Civil Rights (OCR) has posted a list of covered entities that have reported such breaches of protected health information, and OCR will continue to update the list as it receives new reports.
