Archive for HIPAA News
A former East Texas hospital employee faces up to 10 years in prison for HIPAA violations, according to a press release from the U.S. Department of Justice.
Joshua Hippler, 30, formerly of Longview, Texas, faces charges for wrongful disclosure of individually identifiable health information. Hippler was accused of obtaining PHI with the intent to use it for personal gain while employed by the hospital in question from December 1, 2012, through January 14, 2013. A grand jury recently indicted Hippler, according to the press release.
The Office for Civil Rights (OCR) recently named Jocelyn Samuels as the next OCR director, according to govinfosecurity.com.
Samuels currently serves as the acting assistant attorney general for the Civil Rights Division of the U.S. Department of Justice. She will succeed former OCR Director Leon Rodriguez, who was named the director of U.S. Citizenship and Immigration Services, which is a division of Homeland Security.
Samuels will oversee HIPAA compliance at a time when OCR is expected to establish a permanent HIPAA audit program.
The hits just keep on coming. HHS announced June 23 that OCR entered into resolution agreement and $800,000 settlement with Parkview Health System, Inc., in Fort Wayne, Indiana, for alleged HIPAA Privacy Rule violations.
Parkview obtained the medical records of 5,000–8,000 patients while helping Dr. Christine Hamilton transition her patients to new providers upon her retirement. It was believed that the health system was interested in purchasing a portion of Dr. Hamilton’s practice. Parkview failed to safeguard the PHI of these patients when its employees left 71 cardboard boxes of these medical records outside the physician’s home while she was not there. The home is within 20 feet of a public road and is near a shopping center, according to the press release.
The resolution agreement provides that Dr. Hamilton filed the complaint against Parkview. The investigation revealed that when Parkview employees left the medical records at Dr. Hamilton’s home, they were aware that she was not there and had previously refused the delivery of the records.
Parkview’s corrective action plan states that it will do the following:
- Develop, maintain, and revise written HIPAA Privacy Rule policies and procedures for its workforce with HHS approval
- Distribute HHS-approved policies and procedures to members of its workforce
- Ensure that new, approved policies and procedures provide for administrative, technical, and physician safeguards to protect PHI
- Notify HHS in writing within 30 days of a violation of the new, approved policies and procedures
- Provide general safeguards training for its workforce members who have access to PHI
In light of OCR’s recent $4.8 million settlement with New York and Presbyterian Hospital (NYP) and Columbia University (CU) for HIPAA violations, one auditing solutions company released a list of five ways to prevent a breach.
Software provider Netwrix Corporation suggests that healthcare organizations and insurance providers take the following steps to maintain HIPAA compliance:
- Create strict policies and procedures to protect your IT infrastructure and minimize risk
- Perform audits to ensure policies have the desired effect
- Prove you are compliant by generating audit report
- Implement an automated change auditing solution to detect breaches sooner
- Be prepared for requirements to become more strict as breaches occur more frequently
Just months after HHS announced it entered into a $1.7 million resolution agreement with Concentra Health Services, a national healthcare company, for HIPAA violations, the healthcare company is under scrutiny again, according to 23 ABC Kero Bakersfield.
In April, HHS and Concentra agreed upon a monetary settlement and corrective action plan following the theft of an unencrypted laptop computer from the healthcare company’s physician therapy center in Springfield, Missouri, according to the resolution agreement. HHS made an example of Concentra in more ways than one. Aside from the hefty fine it imposed, HHS released a statement about the importance of encryption and cited Concentra as an example of what can go wrong if covered entities (CE) fail to execute appropriate risk management measures to reduce a lack of encryption.
After news of Concentra’s oversights went public, one would assume the CE would want to tie up loose ends. However, the healthcare company may find itself under the watchful eye of HHS once again after records created by Concentra Urgent Care in Bakersfield, California, were found in a public recycling bin, 23 ABC Kero Bakersfield reported.
The urgent care facility closed its doors in February 2013 and legally transferred all of its records to Accelerated Urgent Care in Bakersfield. Although Accelerated Urgent Care was responsible for the records at the time of the breach, it blames a contractor for dumping the records in the public recycling bin without permission, the news station reported.