In the largest HIPAA enforcement action to date, the Department of Health and Human Services (HHS) Office for Civil Rights (OCR) extracted $4.8 million from two leading New York institutions, New York-Presbyterian Hospital (NYP) and Columbia University (CU), despite NYP and CU’s self-disclosure of the breach. OCR charged NYP and CU jointly with failing to secure 6,800 patients’ electronic protected health information (ePHI), which resulted in a 2010 breach. NYP and CU did not learn of the breach until a complaint was filed by a representative of a deceased former NYP patient whose ePHI was found on the Internet. The patient data included status, vital signs, medications and laboratory results.
Larger, more frequent fines may be the new normal as OCR launches its major new audit program. In its press release, HHS wrote that “neither entity had conducted an accurate and thorough risk analysis that identified all systems that access NYP ePHI. As a result, neither entity had developed an adequate risk management plan that addressed the potential threats and hazards to the security of ePHI.” OCR has made clear that risk assessment will be a priority in the upcoming audits. OCR will not be satisfied with “glossy” HIPAA policies and procedures if they are not followed in practice.
To make the point even more explicit, Christina Heide, Acting Deputy Director of Health Information Privacy for OCR, said, “Our cases against NYP and CU should remind health care organizations of the need to make data security central to how they manage their information systems.”
OCR’s investigation began after NYP and CU self-disclosed an inadvertent leakage of certain ePHI to Internet search engines when a computer server was errantly reconfigured. The source of the breach was a CU physician who had tried to deactivate a personally owned computer server on the network containing information on hospital patients. NYP and CU failed to implement technical safeguards for the deactivation of computer servers, so the attempted deactivation resulted in ePHI being posted online.
NYP has agreed to pay HHS a monetary settlement of $3.3 million and CU has agreed to pay $1.5 million. Both entities have also agreed to each undertake a substantive corrective action plan (CAP), which includes a risk analysis, development of a risk management plan, policy and procedure revisions, staff training and regular progress reports. For more information about the settlements and the CAPs, see the NYP Resolution Agreement and the CU Resolution Agreement.
HIPAA Practice Tip: Now is the time to ensure that your HIPAA policies and procedures are being implemented and followed.