Unencrypted Data on Laptop Results in Huge HIPAA Settlement
The U.S. Department of Health and Human Services Office for Civil Rights (OCR) has just received a joint settlement of $1,975,220 for the potential HIPAA violations caused by the theft of a laptop containing unencrypted ePHI data. The large settlement resulted from a failure to adhere to the HIPAA Privacy and Security Rules and take adequate precautions to secure patient data on mobile devices.
The OCR emphasized the importance of securing data held on mobile devices and pointed out that it is the responsibility of healthcare organizations and their business associates to protect any data kept on patients. OCR Deputy Director of Health Information Privacy, Susan McAndrew, believes organizations can do more to increase cybersecurity: “Our message to these organizations is simple: encryption is your best defense against these incidents.”
Following the report of the theft of a laptop from the Springfield Missouri Physical Therapy Center, Concentra Health Services (Concentra) was subjected to an investigation by the OCR. Documentation was uncovered which clearly showed that mobile devices were believed to represent a critical security risk, yet action was not taken to address this issue in time to prevent the data breach.
Data encryption was about to be implemented, although it was clear to the OCR that the efforts made to improve cybersecurity had been insufficient, ultimately leaving patient data exposed and at risk for an unacceptable period of time. It noted that there was a lack of safeguards in place to protect ePHI. In addition to the financial penalty, Concentra has agreed to undertake a review of its compliance policies and procedures and will correct any security issues highlighted.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
In February last year, QCA Health Plan, Inc. of Arkansas reported the theft of a laptop from a car which contained unencrypted data on 148 patients. Following the theft the company encrypted the data on all of its laptops, although the action was not sufficient for the company to avoid a fine. The OCR discovered multiple violations of the HIPAA Privacy and Security Rules with a settlement of $250,000 agreed and a swathe of updates to policies and procedures to be implemented.
Laptop and device theft can all too easily result in HIPAA violations and it is essential that healthcare organizations take the appropriate steps to ensure data is protected and made inaccessible in the event of device theft.
