0990-BreachPRA Supplementary Statement

Supplementary Statement

Office for Civil Rights

Breach Notification Interim Final Regulation

The breach notification interim final regulation was published in the Federal Register on August 24, 2009 (74 FR 42740). This regulation goes into effect September 23, 2009. Due to the short length of time between the publication date and the effective date of the regulation, the Office for Civil Rights used an emergency process to approve the information collection associated with the regulation. In the interim final rule, we published our PRA burden table and invited public comments for 14 days. We received one comment during that time period, and we plan to consider the comment as we develop the final regulation.

The PRA table published in the interim final regulation is different than the PRA burden table found in our current supporting statement. The PRA burden table developed for the interim final regulation contained some errors that we discovered after publication in consultation with our HHS PRA staff. Additionally, we recognized that the published PRA burden table was not comprehensive in terms of the actual burden as demonstrated by the impact analysis in the interim final rule. As a result, we updated the PRA burden table in our supporting statement to correct the errors in the original table and to reflect the actual burden imposed as discussed in the impact analysis published in the interim final regulation. The changes we have made have increased the estimated burden of this regulation on covered entities; however, the changes made reflect a more accurate and complete picture of the burden consistent with the impact analysis in the regulation.

We plan to publish this updated PRA burden table when we publish our 60 day Federal Register notice requesting public comment on this information collection.