Potential HIPAA Violations Settled by Washington County Government
HIPAA compliance is critical in healthcare; however it is not just hospitals and clinics that need to take note of HIPAA regulations. Local and county governments must also comply with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy, Security and Breach Notification Rules or they face the consequences.
Skagit County, Washington is paying the price for failing to implement the appropriate controls and safeguards to protect the data it held. Skagit County agreed to pay the OCR $215,000 following the exposure of data of seven individuals. Data was accessed by unknown third parties after ePHI data was unwittingly transferred to a server accessible to the public.
The data breach was small but involved receipts and ePHI being made public. The investigation following the data exposure revealed numerous other HIPAA violations which potentially exposed the data of 1,581 individuals; data which included ePHI and other highly sensitive information covering the treatment, testing and management of infectious diseases. Other issues were uncovered in the investigation which showed Skagit County had committed a number of errors which were violations of HIPAA regulations under the Privacy, Security, and Breach Notification Rules.
This is the first time that a county government has settled potential HIPAA violations and shows that all covered HIPAA entities will be subjected to the same level of scrutiny, and will incur penalties for cybersecurity breaches or non-compliance with data security rules.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
No HIPAA-covered entity, large or small, can afford to take HIPAA regulations lightly and policies and procedures to protect patient data must be implemented promptly and the appropriate safeguards added to keep sensitive data private. Compliance programs need to be implemented which reduce or eliminate risk and if inadequate efforts are made to address the risks, financial penalties will be issued.
In addition to paying the settlement, Skagit County must enforce its action plan to address all non-compliance issues and must provide status reports to the OCR on its progress.
