OCR Recovers $28.7 Million from 2018 HIPAA Enforcement Actions

King & Spalding

According to a summary released by the HHS Office for Civil Rights (OCR), in 2018, OCR settled 10 cases and was granted summary judgment in one case totaling $28.7 million in recoveries for alleged violations of the Health Insurance Portability and Accountability Act (HIPAA).  This sets the record for total annual recoveries, following $23.5 million recovered by OCR in 2016.  

OCR also set the record for the single largest settlement of $16 million with Anthem, Inc. to settle allegations that Anthem violated certain HIPAA requirements prior to and following a 2015 cyber-attack in which protected health information (PHI) of nearly 79 million individuals was stolen from Anthem’s enterprise data warehouse. This settlement was nearly three times larger than OCR’s previous record settlement of $5.5 million with Advocate Health Care in 2016.  Additional details regarding the Anthem settlement are available here.

OCR’s final settlement of the year was with Cottage Health for $3 million regarding two alleged breaches of unsecured electronic protected health information (ePHI) affecting over 62,500 individuals, one in December 2013 and another in December 2015. The breach exposed unsecured ePHI over the internet including patient names, addresses, dates of birth, Social Security numbers, diagnoses, conditions, lab results and other treatment information. OCR alleged that Cottage Health failed to accurately and thoroughly assess the potential risks and vulnerabilities; failed to implement sufficient security measures; failed to implement procedures to perform periodic evaluations in response to changes affecting the security of ePHI; and failed to enter into a written business associate agreement with a contractor that maintained ePHI on Cottage Health’s behalf. Cottage Health also agreed to enter a corrective action plan. The Cottage Health settlement and corrective action plan can be found here.

OCR’s summary of its 2018 HIPAA settlements can be found here.

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© King & Spalding | Attorney Advertising

Written by:

King & Spalding

King & Spalding on:

Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
- hide
- hide

This website uses cookies to improve user experience, track anonymous site usage, store authorization tokens and permit sharing on social media networks. By continuing to browse this website you accept the use of cookies. Click here to read more about how we use cookies.