Last week, the U.S. Department of Health and Human Services Office for Civil Rights (“OCR”) imposed a civil monetary penalty (“CMP”), to the tune of $2.15 million, against Jackson Health System (“JHS”). The CMP stemmed from JHS’ numerous HIPAA violations that occurred from 2013 through 2016.
Continue Reading A HIPAA Compliance Program “In Disarray” Leads to OCR Imposing a $2.15 Million Civil Monetary Penalty
HIPAA Violations
Out-of-Business File Storage Company Paid $100K for Alleged HIPAA Violations
Posted on
Posted in Data Security, HIPAA
Yesterday, DHHS’s Office for Civil Rights (OCR) announced a $100,000 settlement with a dissolved medical records moving and storage company in Illinois. This is another example of OCR bringing enforcement actions against a business associate under HIPAA. OCR investigated a complaint that the business associate brought medical records to a shredding and recycling facility in…
$3.5 M OCR Settlement for Five Breaches Affecting Fewer Than 500 Patients Each
Posted on
Posted in Data Breach, HIPAA
Yesterday, OCR announced its $3.5 million settlement with Fresenius Medical Care Holdings (“Fresenius”) to resolve alleged HIPAA violations. While the large settlement figure alone is eye-catching, the underlying facts require the complete attention of HIPAA covered entities. OCR is sending a message about HIPAA Security Rule compliance.
Five Fresenius entities in five different states suffered five completely separate but relatively common breaches. Each breach involved stolen or missing equipment. No one breach involved records of more than 500 patients. In fact, combined, the total number of patients impacted was 521. As a reminder, the $5.5 million settlement this time last year with Memorial Health Care System involved the records of 115,143 individuals.
Continue Reading $3.5 M OCR Settlement for Five Breaches Affecting Fewer Than 500 Patients Each