Eyeglass manufacturer and retailer Warby Parker recently settled a 2018 data breach investigation by the Office for Civil Rights (OCR) for $1.5 million. According to OCR’s press release, Warby Parker self-reported that between September and November of 2018, unauthorized third parties had access to customer accounts following a credential stuffing attack. The names, mailing and
OCR Cybersecurity Newsletter Focuses on Controlling Access to ePHI
By Jean Tomasco on
The Office of Civil Rights (OCR) of the U.S. Department of Health & Human Services recently issued its Summer 2021 Cybersecurity Newsletter, which focuses on controlling access to electronic personal health information (ePHI) and the HIPAA Security Rule standards. Citing to a recent report of security incidents and data breaches in the health care…
Fifth Circuit Overturns “Arbitrary and Capricious” $4.3 Million HIPAA Penalty Against Hospital
By Conor Duffy on
On January 14, 2021, the U.S. Court of Appeals for the Fifth Circuit overturned a $4.348 million penalty for alleged HIPAA violations assessed by the U.S. Department of Health & Human Services (HHS) against the University of Texas M.D. Anderson Cancer Center (Hospital). The case arises from an enforcement action undertaken by HHS following the…
OCR Issues Five New HIPAA FAQs on Health Information Apps
By Conor Duffy on
Posted in HIPAA and Health Information
On April 18, 2019, the Department of Health & Human Services Office for Civil Rights (OCR) issued five new FAQs addressing the applicability of HIPAA to the use of software applications (apps) by individuals to receive health information from their providers.
The new FAQs are available here under the Header “Access Right, Apps and APIs.”…
Texas Health System MD Anderson Seeks 5th Circuit Review of HHS Determination that HIPAA Required Encryption of its ePHI
By Conor Duffy on
Posted in HIPAA and Health Information
On April 8, 2019, The University of Texas MD Anderson Cancer Center (MDA) filed a petition with the U.S. Court of Appeals for the Fifth Circuit seeking review of a decision by the Department of Health & Human Services’s (HHS) Departmental Appeals Board (DAB) Appellate Division to uphold $4.35 million in civil money penalties (CMPs)…
OCR Issues Guidance on Disposing Electronic Data and Media
By Linn Foster Freedman on
In its July newsletter on cybersecurity, the Office for Civil Rights (OCR) released “Guidance on Disposing of Electronic Devices and Media,” which outlines the requirements health care providers and business associates have regarding the security of electronic data and media under the HIPAA Security Rule.
The newsletter reminds health care providers and business associates that…
OCR Prevails with ALJ Against MD Anderson for $4.3 Million in HIPAA Fines and Penalties
By Linn Foster Freedman on
It is a rare occurrence when a health care entity challenges the Office for Civil Rights (OCR) regarding proposed fines and penalties for HIPAA violations. In my memory, it has only happened once before.
On June 1, 2018, an Administrative Law Judge (ALJ) granted summary judgment in favor of the OCR against The University of…
New Jersey AG Fines Virtua Medical Group $418,000 for Data Breach Caused by Vendor
By Linn Foster Freedman on
The New Jersey Attorney General’s office announced this week that it has fined Virtua Medical Group, which is comprised of more than 50 medical practices in New Jersey, for failing to protect the privacy of 1,650 patients when their medical information was accessible online.
The information was uploaded to a password-protected FTP website, but during…
Fresenius Pays OCR $3.5M for Five Separate Data Breaches Affecting a Total of 521 Individuals
By Linn Foster Freedman on
Posted in HIPAA and Health Information
In the first settlement for HIPAA violations in 2018, Fresenius Medical Care North America (Fresenius) has agreed to pay $3.5 million to the Office for Civil Rights (OCR) to settle allegations against it relating to five data breaches that occurred over a four month period in 2012. Interestingly, the five separate breaches affected the information…
OCR Settles First Case With Wireless Provider for $2.5 Million
By Linn Foster Freedman on
Posted in Enforcement + Litigation
Touted as the first OCR settlement with a wireless health services provider, the OCR announced on April 24, 2017, that it has settled alleged HIPAA violations with CardioNet, based in Pennsylvania for $2.5 million.
CardioNet self-reported a data beach in January 2012, stating that an unencrypted laptop of one of its employees was stolen from a vehicle parked outside the employee’s home. (Again? Don’t get us started on why employees STILL have unencrypted laptops in their cars.)
The laptop contained the ePHI of 1,391 individuals who received mobile monitoring and response for cardiac arrhythmias by CardioNet. Since the breach involved more than 500 individuals, the OCR conducted an investigation. It alleges that as a result of the investigation, it found that CardioNet “had an insufficient risk analysis and risk management processes in place” and that the HIPAA Security Rule policies and procedures were in draft form and had not been implemented. Further, according to the OCR, CardioNet “was unable to produce any final policies or procedures regarding the implementation of safeguards for ePHI, including those for mobile devices.”
Continue Reading OCR Settles First Case With Wireless Provider for $2.5 Million