On February 6, the U.S. Department of Health and Human Services (HHS) announced a $4.75 million settlement with Montefiore Medical Center (MMC) for a breach of unsecured electronic protected health information (ePHI). The settlement stems from an internal investigation that found that an employee of the New York hospital system sold patient information to an identity theft ring, including patients’ names, addresses, Social Security numbers, and health insurance information.

In May 2015, MMC discovered that the employee had improperly accessed over 12,000 patients’ information through the hospital’s electronic medical record system in early 2013. In response, MMC filed a breach report with HHS in November 2015.

As part of the settlement, MMC entered into a corrective action plan (CAP) requiring it to conduct a thorough assessment of the potential security risks to the confidentiality and integrity of the hospital’s ePHI. The risk assessment must include all of MMC’s locations and facilities and evaluate the risks to the security of ePHI in electronic equipment, data systems, and programs and applications used by MMC that contain, store, transmit, and receive ePHI.

Under the CAP, MMC is also required to develop a written risk management plan that sufficiently addresses any security risks identified by the risk assessment, and review and revise its privacy and security rules policies and procedures based on the risk assessment’s findings. If HHS determines that MMC is in breach of the CAP during its two-year term, HHS may impose a civil monetary penalty.

Healthcare providers’ compliance obligations under HIPAA’s Privacy and Security Rules include conducting periodic risk assessments of their data infrastructure in order to identify any risks and vulnerabilities.