Late last week, the U.S. Department of Health and Human Services Office for Civil Rights (OCR) announced a $3.5 million settlement with a large provider of kidney dialysis services (the “Provider”) for multiple violations of the Health Insurance Portability and Accountability Act and its associated regulations (HIPAA). In early 2013, the Provider filed five separate breach reports for incidents that occurred in 2012 and involved several of its facilities. These breaches involved, among other things, theft of desktop computers from a medical office, theft of a USB drive from a workforce member’s car, loss of a computer hard drive, and theft of a laptop from a parked car.
As part of its settlement with OCR, the Provider entered into a corrective action plan (CAP) that requires the company to improve its policies and procedures for the protection of patient health information. The CAP specifically requires the Provider to conduct a thorough, system-wide risk analysis of potential risks to and vulnerabilities of the confidentiality, integrity, and availability of its ePHI; review and revise its policies and procedures, including those concerning device and media controls and facility access controls; and revise and enhance its health privacy training program.
This settlement once again emphasizes the importance of a comprehensive, up-to-date risk analysis. It also highlights the fact that mobile device privacy and security continue to be important issues for a range of healthcare providers. Moreover, it is a reminder that OCR can, and does, take interest in smaller breaches. Each of the five reported breaches affected fewer than 500 individuals. Contact a member of Venable’s health law team to discuss how your organization can stay ahead of the curve in today’s enforcement environment.
Please find the OCR press release here.