If your agency experienced a small HIPAA breach last year, the clock is counting down on alerting the HHS Office for Civil Rights. “If a breach of unsecured protected health information affects fewer than 500 individuals, a covered entity must notify the Secretary of the breach within 60 days of the end of the calendar year in which the breach was discovered,” OCR reminds in its HIPAA Breach Notification Rule guidance. And that day is March 1, 2022, for small breaches that occurred in 2021. You can submit breaches through the OCR portal at https://ocrportal.hhs.gov/ocr/breach/wizard_breach.jsf.