Beth Israel Fined $100,000 for HIPAA Data Breach
A laptop computer was stolen from Beth Israel Deaconess Medical Center in May 2012. It was not being transported and was not left unattended in a car. The theft occurred inside the hospital with the laptop stolen from a physician’s desk.
Data stored on the laptop included Protected Health Information of close to 4,000 patients and employees, including Social Security numbers, addresses, telephone numbers and other personal identifiable information. In total, 3,796 patients and employees of Beth Israel had confidential data exposed and potentially exposed to criminals.
Beth Israel Deaconess Medical Center has now agreed to settle a complaint and pay $100,000 after the Massachusetts attorney general’s office alleged that the laptop theft could have been prevented had proper security measures been in place.
There were two area of concern: General security at the hospital which facilitated the theft of the device and a failure to use data encryption to protect the PHI of patients. The Attorney General’s office claimed that the data security failures at Beth Israel broke the law and lax standards were responsible for the disclosure of PHI. According to Attorney General, Martha Coakley, “The healthcare industry’s increased reliance on technology makes it more important than ever that providers ensure patients’ personal information and protected health information is secure.”
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The data security breach which led to the settlement occurred over two and a half years ago, and during intervening time Beth Israel has implemented changes to policies and procedures to improve data security and ensure that even if a laptop is lost or stolen, the PHI of patients will remain protected. The medical center has also employed state of the art technology to improve data security according to a statement issued by Beth Israel’s Chief Information Officer Dr. John Halama.
“Every device we purchase is encrypted before it is used, and every employee must attest on an annual basis that his or her personal devices are also encrypted.” He said.
The message to other medical centers is clear: It is better – and cheaper – to invest in data security before a breach, rather than invest in it afterwards and also have to pay a large financial penalty for a HIPAA violation.
