CoChat
Sign Up
Cited by 43Thoreau and American LiteraturePrivacy, Security, and Data ProtectionInformation and Cyber Security

The role of HIPAA omnibus rules in reducing the frequency of medical data breaches: insights from an empirical study

Open access
YARAGHI, NIAM, GOPAL, RAM D.·2018·The Milbank Quarterly
DOI 10.1111/1468-0009.12314PMC PMC5835681
Open this paper in CoChat — free accountOpen PDF

Abstract

Policy Points: Frequent data breaches in the US health care system undermine the privacy of millions of patients every year—a large number of which happen among business associates of the health care providers that continue to gain unprecedented access to patients’ data as the US health care system becomes digitally integrated. Implementation of the HIPAA Omnibus Rules in 2013 has led to a significant decrease in the number of privacy breach incidents among business associates. Context: Frequent data breaches in the US health care system undermine the privacy of millions of patients every year. A large number of such breaches happens among business associates of the health care providers that continue to gain unprecedented access to patients’ data as the US health care system becomes digitally integrated. The Omnibus Rules of the Health Insurance Portability and Accountability Act (HIPAA), which were enacted in 2013, significantly increased the regulatory oversight and privacy protection requirements of business associates. The objective of this study is to empirically examine the effects of this shift in policy on the frequency of medical privacy breaches among business associates in the US health care system. The findings of this research shed light on how regulatory efforts can protect patients’ privacy. Methods: Using publicly available data on breach incidents between October 2009 and August 2017 as reported by the Office for Civil Rights (OCR), we conducted an interrupted time‐series analysis and a difference‐in‐differences analysis to examine the immediate and long‐term effects of implementation of HIPAA omnibus rules on the frequency of medical privacy breaches. Findings: We show that implementation of the omnibus rules led to a significant reduction in the number of breaches among business associates and prevented 180 privacy breaches from happening, which could have affected nearly 18 million Americans. Conclusions: Implementation of HIPAA omnibus rules may have been a successful federal policy in enhancing privacy protection efforts and reducing the number of breach incidents in the US health care system.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.1111/1468-0009.12314

Cites

19 of 19 references verified0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Hacking or information technology breaches tend to affect a significant number of individuals, with over 7 million individuals affected in 2014.

    “However, hacking or information technology breaches tend to affect a significant number of individuals, with over 7 million individuals affected in 2014 ( 1,20,21 ).”

    From Review of HIPAA, Part 2: Limitations, Rights, Violations, and Role for the Imaging Technologist (2020) · cites this paper as [21]

    The Results (page not available in our copy) say that hacking/IT incidents affected the largest number of people among breaches at covered entities. They do not report that over 7 million individuals were affected in 2014, so the year-specific figure is unsupported by this source. (LLM, conf=0.87)

    Experimental — accuracy not yet measured

  • PHS is a process of collecting, analyzing and interpreting data related to a specific disease for administering and assessing public health on the whole.

    “PHS is a process of collecting, analyzing and interpreting data related to a specific disease for administering and assessing public health on the whole [64].”

    From Secondary Use of Electronic Health Record: Opportunities and Challenges (2020) · cites this paper as [64]

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

Flagged first, then by citations

Research works printed but not linked: 1

  1. Yaraghi N. Hackers, Phishers, and Disappearing Thumb Drives: Lessons Learned From Major Health Care Data Breaches. Washington, DC: The Brookings Institution; 2016. https://scholar.google. com/citations?view_op=view_citation&hl=en&user=jbq8Jn kAAAAJ&citation_for_view=jbq8JnkAAAAJ:5nxA0vEk-isC. Accessed January 10, 2017.

Cited by

Sorted by citations

Related

Authors
YARAGHI, N., & GOPAL, R. D.
Affiliations
  • Brookings Institution (US)
  • University of Connecticut (US)
Corresponding author
YARAGHI, NIAM
ORCID
Venue
The Milbank Quarterly
Publisher
Wiley
Published
2018-03
Volume
96
Issue
1
Pages
144-166
ISSN
  • 0887-378X (ISSN-L)
  • 1468-0009
DOI
10.1111/1468-0009.12314
PMC
PMC5835681
OpenAlex
W2793515038
Cited by
43
References
19
Citations by year
2026: 5 · 2025: 7 · 2024: 4 · 2023: 6 · 2022: 7 · 2021: 5 · 2020: 3 · 2019: 6
FWCI
5.64
Type
journal article
Language
en
Open access
Licence
onlinelibrary.wiley.com/termsAndConditions#vor (vor, 4 d)
Locations
  • Milbank Quarterly (publishedVersion)
  • Europe PMC (PubMed Central) (publishedVersion)
  • PubMed Central (publishedVersion)
  • PubMed (publishedVersion)
Funders
California Health Care Foundation
Topics
  • Physical Sciences › Computer Science › Information Systems › Thoreau and American Literature
  • Social Sciences › Sociology and Political Science › Privacy, Security, and Data Protection
  • Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
Keywords
healthcare data breaches, business associates, healthcare privacy, patient privacy protection, Office for Civil Rights, health information privacy, digital health integration
MeSH terms
Confidentiality, Security Measures, United States, Health Insurance Portability and Accountability Act, Government Regulation

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review