$5.5 Million HIPAA Settlement Shows Importance of Audit Controls
Memorial Healthcare System (MHS) has paid the US Department of Health and Human Services $5.5 million to settle potential violations of the Health Insurance Portability and Accountability Act (HIPAA).
In 2012, MHS report to the HHS Office for Civil Rights (OCR) that the protected health information of 115,143 individuals had been impermissibly accessed by its employees and disclosed to affiliated physician office staff. The breach affected individuals’ names, dates of birth, and social security numbers.
MHS is a non-profit corporation which operates six hospitals, a nursing home, an urgent care center and a variety of affiliated health care facilities throughout South Florida. The healthcare system is affiliated with physician offices through an Organized Health Care Arrangement.
The breach occurred when login credentials of a former employee of a related physician’s office were used to access the ePHI maintained by MHS. The access, which occurred on a daily basis without detection from April 2011 to April 2012, affected 80,000 individuals.
The OCR investigation found that MHS failed to implement procedures with respect reviewing, modifying and/or terminating users’ right of access, as required by the HIPAA Rules. Further, MHS failed to regularly review records of information system activity on applications that maintain electronic protected health information by workforce users and users at affiliated physician practices, despite having identified the problem on several risk analyses conducted by MHS from 2007 to 2012.
At Tiger Shredding, we understand the importance of risk mitigation as it relates to HIPAA. If you would like us to come in and audit your processes, with regard to PHI and HIPAA information, please give us a call at 225-303-0125 or send us a note via our quote request page: http://tigershreddingla.com/request-a-quote/. Tiger Shredding is a Baton Rouge-based paper shredding company who specializes in onsite and off-site document destruction service.