Data breach results in $4.8 million HIPAA settlement.

1. DATA BREACH RESULTS IN
$4.8M HIPAA SETTLEMENT
Participants have a fundamental right under
HIPAA’s privacy rules to receive their protected
health information (PHI). It is the responsibility
of covered entities to protect that information;
something that may be especially dicult in
this technology age.
Recently, two health care entities
(covered entities) learned just how
dicult when they agreed to the
largest settlement to date for
charges that they failed to secure
the electronic PHI (ePHI) for
thousands of patients.
$4.8M
settlement
In September 2010, the two covered entities filed a joint breach report
regarding the disclosure of ePHI of 6,800 individuals.
The investigation revealed
the breach was caused
when a physician attempted
to deactivate a personally-owned
computer server on
the network that contained a
patient’s ePHI.
Lacking technical safeguards,
the server deactivation
caused the ePHI to be
accessible on the Internet.
The investigation revealed
that no eort was made
prior to the breach to assure
the servers were secure and
had software protections.
Both entities agreed to a corrective plan, which all employers would be
well advised to review:
Undertake a risk
analysis
Develop a risk
management plan
Revise policies
and procedures
Train sta Review progress
copyright 2014