Lahey Hospital and Medical Center has agreed to settle potential violations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy and Security Rules with the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR). Lahey will pay $850,000 and will adopt a robust corrective action plan to correct deficiencies in its HIPAA compliance program.
Lahey is a nonprofit teaching hospital affiliated with Tufts Medical School, providing primary and specialty care in Burlington, Massachusetts.
Lahey notified OCR that a laptop was stolen from an unlocked treatment room during the overnight hours on August 11, 2011. The laptop hard drive contained the protected health information (PHI) of 599 individuals. Evidence obtained through OCR’s subsequent investigation indicated widespread non-compliance with the HIPAA rules, including:
• Failure to conduct a thorough risk analysis of all of its electronic PHI (ePHI);
• Failure to physically safeguard a workstation that accessed ePHI;
• Failure to implement and maintain policies and procedures regarding the safeguarding of ePHI;
• Lack of a unique user name for identifying and tracking user identity with respect to the workstation at issue in this incident;
• Failure to implement procedures that recorded and examined activity in the workstation at issue in this incident; and
• Impermissible disclosure of 599 individuals’ PHI.
In addition to the $850,000 settlement, Lahey must address its history of noncompliance with the HIPAA Rules by providing OCR with a comprehensive, enterprise-wide risk analysis and corresponding risk management plan, as well as reporting certain events and providing evidence of compliance.
HHS offers tips on how to protect and secure health information when using mobile devices (note that while this particular site is geared to health care providers, the rules on safeguarding data also apply to health plan sponsors and their business associates): https://www.healthit.gov/providers-professionals/your-mobile-device-and-health-information-privacy-and-security
This settlement should serve as a reminder to all HIPAA covered entities and business associates of the importance of conducting periodic risk assessments and of safeguarding mobile devices.