The Office for Civil Rights has announced that it has settled with Lakeland, Florida based Advanced Care Hospitalists (ACH) for $500,000 for allegations of an impermissible disclosure of protected health information by one of its business associates. ACH provides contract internal medicine physicians to nursing homes and hospitals.
According to the press release, between November 2011 and June 2012, ACH engaged an individual who claimed to be a representative of Doctor’s First Choice Billings, Inc., which provides medical billing services. Although the individual used First Choice’s website and company affiliation, the owner of First Choice denied that the individual was employed by First Choice, and stated that the services were provided without the knowledge or permission of First Choice.
On February 11, 2014, a hospital notified ACH that patient information, including names, Social Security numbers and clinical information, was accessible through First Choice’s website. The website was subsequently taken offline.
Thereafter, ACH submitted a breach notification report to OCR which stated that the PHI of 400 individuals had been impermissibly disclosed through the website, but later amended the report to add another 8,855 patients whose PHI was impermissibly disclosed.
The $500,000 settlement was based upon OCR’s investigation which found that ACH had not implemented any HIPAA policies and procedures until April 1, 2014, and that ACH was disclosing PHI to the individual without entering into a Business Associate Agreement with the individual. The OCR alleges that ACH impermissibly disclosed the PHI of 9,255 patients to the individual, which was subsequently exposed through First Choice’s website.
In addition to the $500,000 payment, ACH also agreed to a Corrective Action Plan to address its HIPAA compliance..
This post is also being shared on our Data Privacy + Security Insider blog. If you’re interested in getting updates on developments affecting data privacy and security, we invite you to subscribe to the blog.