Idaho State University Settles HIPAA Security Case for $400, 000

[Erica Absetz <erica () riskbasedsecurity com>]

http://www.phiprivacy.net/?p=12728

Idaho State University (ISU) has agreed to pay $400,000 to the U.S.
Department of Health Human Services (HHS) to settle alleged violations
of the Health Insurance Portability and Accountability Act of 1996
(HIPAA) Security Rule.  The settlement involves the breach of
unsecured electronic protected health information (ePHI) of
approximately 17,500 patients at ISU’s Pocatello Family Medicine
Clinic.  That breach wasreported on this blog in August 2011.

ISU operates 29 outpatient clinics and is responsible for providing
health information technology systems security at those clinics.
Between four and eight of those ISU clinics are subject to the HIPAA
Privacy and Security Rules, including the clinic where the breach
occurred.

The HHS Office for Civil Rights (OCR) opened an investigation after
ISU notified HHS of the breach in which the ePHI of approximately
17,500 patients was unsecured for at least 10 months, due to the
disabling of firewall protections at servers maintained by ISU. OCR’s
investigation indicated that ISU’s risk analyses and assessments of
its clinics were incomplete and inadequately identified potential
risks or vulnerabilities.  ISU also failed to assess the likelihood of
potential risks occurring:

i. ISU did not conduct an analysis of the risk to the confidentiality
of ePHI as part of its security management process from April 1, 2007
until November 26, 2012;

ii. ISU did not adequately implement security measures sufficient to
reduce the risks and vulnerabilities to a reasonable and appropriate
level from April 1, 2007 until November 26, 2012; and

iii. ISU did not adequately implement procedures to regularly review
records of information system activity to determine if any ePHI was
used or disclosed in an inappropriate manner from April 1, 2007 until
June 6, 2012.

OCR concluded that ISU did not apply proper security measures and
policies to address risks to ePHI and did not have procedures for
routine review of their information system in place, which could have
detected the firewall breach much sooner.

“Risk analysis, ongoing risk management, and routine information
system reviews are the cornerstones of an effective HIPAA security
compliance program,” said OCR Director Leon Rodriguez. “Proper
security measures and policies help mitigate potential risk to patient
information.”

ISU has agreed to a comprehensive corrective action plan to address
the issues uncovered by the investigation and its failure to ensure
uniform implementation of required HIPAA Security Rule protections at
each of its covered clinics.

The Resolution Agreement does not constitute an admission of liability by ISU.

SOURCE: HHS
_______________________________________________
Dataloss-discuss Mailing List (dataloss-discuss () datalossdb org)
Archived at http://seclists.org/dataloss/
Unsubscribe at http://datalossdb.org/mailing_list

Supporters:

Risk Based Security (http://www.riskbasedsecurity.com/)
Risk Based Security equips organizations with security intelligence, risk
management services and on-demand security solutions to establish
customized risk-based programs to address information security and
compliance challenges. 

Tenable Network Security (http://www.tenable.com/)
Tenable Network Security provides a suite of solutions which unify real-time
vulnerability, event and compliance monitoring into a single, role-based, interface
for administrators, auditors and risk managers to evaluate, communicate and
report needed information for effective decision making and systems management.