A breach notification list is maintained by which organization?

• A. Office of the National Coordinator
• B. HIMSS
• C. American Health Information Management Association
• D. Department of Health and Human Services

Answer: (D)

Under HIPAA, when a breach involving protected health information occurs, covered entities and business associates report the incident to the Department of Health and Human Services. The HHS Office for Civil Rights collects these breach reports and publishes a public list of breaches affecting 500 or more individuals. This makes the Department of Health and Human Services the organization that maintains the breach notification list. The other entities—ONC, HIMSS, and AHIMA—do not maintain this official breach registry; ONC handles health IT policy, while the professional associations focus on education and advocacy rather than hosting the breach notices.