Tag Archives: HIPAA

New Jersey AG Fines Virtua Medical Group $418,000 for Data Breach Caused by Vendor

The New Jersey Attorney General’s office announced this week that it has fined Virtua Medical Group, which is comprised of more than 50 medical practices in New Jersey, for failing to protect the privacy of 1,650 patients when their medical information was accessible online. The information was uploaded to a password-protected FTP website, but during … Continue Reading

Open Enrollment for 2018: Don’t Forget about HIPAA!

With open enrollment in full swing for many employers, now is a good time to review employee benefit communications. Plan sponsors of health plans are generally responsible for properly administering all of the health plan notices required by law, including HIPAA. To ease the administrative burden and to cut costs, these notices can, and often … Continue Reading

OCR Settles With Texas Health System for $2.4 Million for Disclosing PHI to Media In a Press Release

The Office for Civil Rights (OCR) issued a press release today announcing that it has settled alleged HIPAA violations with Memorial Hermann Health System (MHHS) for $2.4 million. According to the Resolution Agreement it has inked with the OCR, MHHS must also implement a corrective action plan, including updating its policies and procedures, training staff … Continue Reading

$5.5 Million Shelled Out to OCR for Alleged HIPAA Violations

Florida Memorial Healthcare Systems has agreed to pay the Office for Civil Rights (OCR) $5.5 million to settle alleged HIPAA violations relating to an incident that occurred in April 2012 that two employees accessed patient information of 106,000 patients in an unauthorized manner and with criminal intent, including their names, dates of birth, and Social … Continue Reading

Children’s Medical Center of Dallas Clobbered by OCR

In a rare move by the OCR, it assessed a $3.2 million fine against Children’s Medical Center of Dallas (Children’s) after it issued a Notice of Proposed Determination against Children’s and Children’s failed to request a hearing. The Notice was issued following the OCR’s investigation of two self-reported data breaches. The first involved the theft … Continue Reading

21st Century Cures Act Includes Prohibition on Information Blocking and Mandates for Additional HIPAA Guidance

On November 30, 2016, the U.S. House of Representatives voted strongly in favor of the 21st Century Cures Act (the Act), an expansive health bill that addresses the discovery and development of new medical therapies as well the delivery of health care treatment by providers. In 2015, the House had previously approved an earlier version … Continue Reading

OCR Alerts Listservs About Fake Phishing Email to Covered Entities and Business Associates

On November 28, 2016, the Office for Civil Rights (OCR) issued an Alert to its listservs that a phishing email is being circulated on “mock HHS Departmental letterhead under the signature of OCR”s Director, Jocelyn Samuels” to employees of HIPAA covered entities and business associates. The email looks official and tells the recipient that it … Continue Reading

Three Former Warner Chilcott District Managers Prosecuted for HIPAA Violations

The United States Attorney’s Office for the District of Massachusetts recently announced that three former district managers of the pharmaceutical firm Warner Chilcott have been sentenced for violating the Health Insurance Portability and Accountability Act (HIPAA) and committing healthcare fraud. The allegations include that the district managers directed certain sales representatives to fill out prior … Continue Reading

Record HIPAA Settlement Paid by Hospital Chain

Federal regulators announced last week that Illinois’ largest hospital chain would pay $5.5 million, a record payment under the Health Insurance Portability and Accountability Act (HIPAA), in connection with three 2013 data breaches that affected the protected health information of millions of its patients. The Advocate Health Care Network, which manages twelve hospitals and hundreds … Continue Reading

Oregon Health & Science University pays $2.7M penalty for data breaches

Oregon Health & Science University (OHSU) has agreed to settle alleged HIPAA violations involving two separate data breaches with the Office for Civil Rights (OCR) for $2.7 million. In the span of three months in 2013, OHSU experienced two reportable data breaches, which triggered investigations by the OCR. The first occurred when an unencrypted laptop … Continue Reading

Physical security still an issue: Pruitt Health suffers breach in break-in

The importance of physical security and the risk associated with the unauthorized access to or loss of paper records is clear from recent experiences of Pruitt Health in South Carolina. On March 2, 2016, an intruder broke the front door glass of one of its home health locations and had access to paper medical records … Continue Reading

OCR levies first fine ever directly against business associate

Our predictions that the Office for Civil Rights (OCR) will become more aggressive with audits, investigations, and fines against HIPAA business associates has come true. On June 24, 2016, the OCR announced that it has settled an investigation with Catholic Health Services of the Archdiocese of Philadelphia (CHCS), stemming from CHCS’ capacity as a HIPAA … Continue Reading

Illinois data breach law amended and includes new twists

Governor Bruce Rauner signed several new provisions into law amending Illinois’ Personal Information Privacy Act, including health insurance and medical information into the definition of personal information that triggers notification in the event of a breach. Health insurance information under the law includes an individual’s health insurance policy number or subscriber identification number as well … Continue Reading

Joint Commission lifts ban on physicians texting patient orders

The Joint Commission, which is the national accrediting organization for health care organizations, has long banned physicians using text messages to place orders for patient care due to data security concerns. In 2011, the Joint Commission stated that texting was not acceptable for health care providers to text orders for patient care, treatment or services. … Continue Reading

FTC, ONC, OCR and FDA release online tool for mobile health app developers

While attending the International Association of Privacy Professionals annual global event, and listening to Chairwoman Edith Ramirez discuss the Federal Trade Commission’s (FTC) concerns about consumer privacy, the FTC, the Office of National Coordinator for Health Information Technology (ONC), Office for Civil Rights (OCR), and the Food and Drug Administration (FDA) announced that they had … Continue Reading

Transfer of healthcare website information to Facebook alleged to be a HIPAA violation

Filed under the title of creative lawyering, a putative class action case has been filed against Facebook in federal court in Northern California alleging that health care providers and medical organizations have violated HIPAA by allowing Facebook to access user data from searches on the medical providers’ websites. The plaintiffs allege that when they visit … Continue Reading

Wearable device data discoverable in the courtroom?

One in five U.S. consumers are tracking their every movement, from their heart-rate, skin temperature, respiratory rate to their activity levels, food intake, weight, and sleep patterns. With this so-called ‘black box’ for the human body, this data collected through our wearable fitness devices has great potential to be used to bolster or dispute a … Continue Reading

Deadline for reporting 2015 data breaches to OCR quickly approaching

Pursuant to HIPAA/HITECH, covered entities are required to report breaches of unsecured protected health information that occurred in 2015 and affected less than 500 individuals to the Office for Civil Rights no later than 60 days after the end of the calendar year. To be safe, covered entities may wish to complete their online reporting … Continue Reading

Lincare, Inc. ordered to pay civil monetary fines for HIPAA violations

In an unusual scenario, in fact, only the second time in history, the Office for Civil Rights (OCR) was successful before an Administrative Law Judge (ALJ) in obtaining an order for the payment of civil monetary fines as a result of HIPAA violations. The OCR assessed a penalty of $240,000 against Lincare Holdings, Inc. (Lincare) … Continue Reading

HHS issues new guidance on individual access to PHI under HIPAA

On January 7, 2015, HHS issued new guidance (Guidance) regarding an individual’s right to access his or her health information under HIPAA’s Privacy Rule. The Guidance emphasizes that HIPAA, while protecting the privacy and confidentiality of individuals’ health information, also recognizes the importance of providing individuals with access to their health information. The Guidance reviews … Continue Reading

FTC settles with software provider over misleading customers about encryption of patient data

The Federal Trade Commission (FTC) announced on January 5, 2016, that it has agreed to settle an investigation with Henry Schein Practice Solutions, Inc. (Schein), an office management software provider for dental practices based in Utah, for $250,000 for allegations of falsely advertising the level of encryption it provided for patient data. The FTC alleged … Continue Reading

ProPublica releases HIPAA Helper

A damning series of reports by ProPublica has revealed that based upon its analysis of federal data, “hundreds of health providers nationwide” have repeatedly violated HIPAA between 2011 and 2014. According to the report, the Veterans Administration was most frequent violator of HIPAA, with 220 violations between 2011 and 2014 (based upon complaints that resulted in … Continue Reading

NAIC cybersecurity task force adopts Cybersecurity Bill of Rights for insurance consumers

On October 14, the National Association of Insurance Commissioners (NAIC) Cybersecurity (EX) Task Force released an updated draft of its Cybersecurity Bill of Rights. The bill, which updates a prior draft published for comment in July 2015, details certain rights of insurance consumers in connection with protection of personal information and responses to data breaches … Continue Reading

Arrest of immigrant at Texas clinic isn’t a HIPAA issue

Immigration advocates have alleged that a Texas clinic violated health care privacy laws by calling the police when a woman gave a fake driver’s license as authentication to receive medical services. But if the clinic provided services to someone who was clearly not using proper identification, it could be aiding the commission of medical identity … Continue Reading
LexBlog