HHS announces first HIPAA breach settlement involving less than 500 patients

[Jake Kouns <jkouns () opensecurityfoundation org>]

http://www.hhs.gov/news/press/2013pres/01/20130102a.html

Hospice of North Idaho settles HIPAA security case for $50,000

The Hospice of North Idaho (HONI) has agreed to pay the U.S.
Department of Health and Human Services’ (HHS) $50,000 to settle
potential violations of the Health Insurance Portability and
Accountability Act of 1996 (HIPAA) Security Rule.  This is the first
settlement involving a breach of unprotected electronic protected
health information (ePHI) affecting fewer than 500 individuals.

The HHS Office for Civil Rights (OCR) began its investigation after
HONI reported to HHS that an unencrypted laptop computer containing
the electronic protected health information (ePHI) of 441 patients had
been stolen in June 2010.  Laptops containing ePHI are regularly used
by the organization as part of their field work.  Over the course of
the investigation, OCR discovered that HONI had not conducted a risk
analysis to safeguard ePHI.  Further, HONI did not have in place
policies or procedures to address mobile device security as required
by the HIPAA Security Rule.  Since the June 2010 theft, HONI has taken
extensive additional steps to improve their HIPAA Privacy and Security
compliance program.

“This action sends a strong message to the health care industry that,
regardless of size, covered entities must take action and will be held
accountable for safeguarding their patients’ health information.” said
OCR Director Leon Rodriguez. “Encryption is an easy method for making
lost information unusable, unreadable and undecipherable.”

The Health Information Technology for Economic and Clinical Health
(HITECH) Breach Notification Rule requires covered entities to report
an impermissible use or disclosure of protected health information, or
a “breach,” of 500 individuals or more to the Secretary of HHS and the
media within 60 days after the discovery of the breach.  Smaller
breaches affecting less than 500 individuals must be reported to the
Secretary on an annual basis.

A new educational initiative, Mobile Devices: Know the RISKS. Take the
STEPS. PROTECT and SECURE Health Information, has been launched by OCR
and the HHS Office of the National Coordinator for Health Information
Technology (ONC) that offers health care providers and organizations
practical tips on ways to protect their patients’ health information
when using mobile devices such as laptops, tablets, and smartphones.
For more information, visit www.HealthIT.gov/mobiledevices.

The Resolution Agreement can be found on the OCR website at
http://www.hhs.gov/ocr/privacy/hipaa/enforcement/examples/honi-agreement.pdf
_______________________________________________
Dataloss-discuss Mailing List (dataloss-discuss () datalossdb org)
Archived at http://seclists.org/dataloss/
Unsubscribe at http://datalossdb.org/mailing_list

Supporters:

Risk Based Security (http://www.riskbasedsecurity.com/)
Risk Based Security equips organizations with security intelligence, risk
management services and on-demand security solutions to establish
customized risk-based programs to address information security and
compliance challenges. 

Tenable Network Security (http://www.tenable.com/)
Tenable Network Security provides a suite of solutions which unify real-time
vulnerability, event and compliance monitoring into a single, role-based, interface
for administrators, auditors and risk managers to evaluate, communicate and
report needed information for effective decision making and systems management.