Massachusetts Provider to Pay $1.5 Million to Resolve HIPAA Violations
September 21, 2012
On September 17, 2012, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) announced a settlement requiring a Harvard Medical School teaching hospital, Massachusetts Ear and Eye Infirmary and Massachusetts Eye and Ear Associates, Inc. (collectively referred to as "MEEI"), to pay a $1.5 million penalty relating to its failure to comply with the Health Insurance Portability and Accountability Act (HIPAA) Security Rule. In addition to the settlement, MEEI is required to adhere to a corrective action plan to improve policies and procedures to safeguard the privacy and security of their patients’ protected health information. Finally, MEEI must retain an independent monitor who will conduct assessments of MEEI’s compliance with the corrective action plan and submit reports to HHS for a 3-year period.
The investigation by OCR followed a report by MEEI of a breach involving the theft of an unencrypted personal laptop containing the electronic protected health information (ePHI) of MEEI patients and research subjects. The information contained on the laptop included patient prescriptions and clinical information. Reporting of a breach is required by the Health Information Technology for Economic and Clinical Health Act (HITECH) Breach Notification Rule.
OCR’s investigation concluded that MEEI failed to take the necessary steps to comply with the HIPAA Security Rule, such as:
- Conducting a thorough analysis of the risk to the confidentiality of ePHI maintained on portable devices;
- Implementing security measures to sufficiently ensure the confidentiality of ePHI that MEEI created, maintained, and transmitted using portable devices;
- Adopting and implementing policies and procedures to restrict access to ePHI to authorized users of portable devices; and
- Adopting and implementing policies and procedures to address security incident identification, reporting and response.
OCR’s investigation indicated that these failures continued over an extended period of time, therefore demonstrating a long-term organizational disregard for the requirements of the Security Rule.
The MEEI Resolution Agreement follows a resolution agreement announced earlier this year with Arizona-based Phoenix Cardiac Surgery, P.C. (PCS), which required PCS to pay a $100,000 penalty and imposed a corrective action plan. Health care providers and their business associates have yet another stern reminder from OCR of the importance of taking proper steps to secure ePHI and to take all necessary steps to comply with HIPAA. The MEEI Resolution Agreement provides more evidence of the growing exposures to health care providers and illuminates that covered entities and their business associates need to carefully and appropriately manage their HIPAA responsibilities.
If you would like help making sure your practice maintains compliance with HIPAA and HITECH, please contact:
H. Kennedy Hudner at 860.240.6029 / khudner@murthalaw.com
Christina M. Hage at 203.772.7704 / chage@murthalaw.com
If you need additional information concerning legal requirements and practice tips applicable to sensitive personal or confidential information, please contact any of the attorneys in our Information Security and Privacy practice group. A group description and contact information is available at:
https://www.murthalaw.com/practices_industries/information-security-privacy
To view a printer-friendly version, please click the pdf link below:
