Federal law known as the Health Information Portability and Accountability Act (HIPAA) generally requires health care providers to notify people within 60 days of discovering a breach affecting their personal health data. The Department of Health and Human Services is already investigating whether UnitedHealth is compliant with HIPAA obligations to protect patient data. HHS can use HIPAA to fine companies for failing to protect patient data. The department announced a $4.75 million settlement in February with a nonprofit hospital system in New York for “data security failures” that the department said resulted in an employee stealing and selling patient data. On May 31, the HHS Office for Civil Rights clarified that health care providers can delegate that obligation to Change Healthcare.

---

Persons: Andrew, New Hampshire Democratic Sen, Maggie Hassan, Tennessee Republican Sen, Marsha Blackburn, ”, Eric Hausman, Hassan, Blackburn, Sen, Ron Wyden, UnitedHealth’s Organizations: Washington CNN, UnitedHealth, New, New Hampshire Democratic, Tennessee Republican, of Health, Human Services, CNN, HHS, Healthcare, Civil Rights, American Hospital Association, Optum, Capitol, Senate, Oregon Democrat, Federal Trade Commission, Securities and Exchange Commission, SEC Locations: New Hampshire, Tennessee, New York, Wyden