HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Potential HIPAA Violations Settled by Washington County Government

HIPAA compliance is critical in healthcare; however it is not just hospitals and clinics that need to take note of HIPAA regulations. Local and county governments must also comply with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy, Security and Breach Notification Rules or they face the consequences.

Skagit County, Washington is paying the price for failing to implement the appropriate controls and safeguards to protect the data it held. Skagit County agreed to pay the OCR $215,000 following the exposure of data of seven individuals. Data was accessed by unknown third parties after ePHI data was unwittingly transferred to a server accessible to the public.

The data breach was small but involved receipts and ePHI being made public. The investigation following the data exposure revealed numerous other HIPAA violations which potentially exposed the data of 1,581 individuals; data which included ePHI and other highly sensitive information covering the treatment, testing and management of infectious diseases. Other issues were uncovered in the investigation which showed Skagit County had committed a number of errors which were violations of HIPAA regulations under the Privacy, Security, and Breach Notification Rules.

This is the first time that a county government has settled potential HIPAA violations and shows that all covered HIPAA entities will be subjected to the same level of scrutiny, and will incur penalties for cybersecurity breaches or non-compliance with data security rules.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

No HIPAA-covered entity, large or small, can afford to take HIPAA regulations lightly and policies and procedures to protect patient data must be implemented promptly and the appropriate safeguards added to keep sensitive data private. Compliance programs need to be implemented which reduce or eliminate risk and if inadequate efforts are made to address the risks, financial penalties will be issued.

In addition to paying the settlement, Skagit County must enforce its action plan to address all non-compliance issues and must provide status reports to the OCR on its progress.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.