Advocate Health Care Network, of Illinois, reported three breaches in 2013. Four desktop computers containing approximately four million patients’ ePHI. The OCR stated “This significant settlement, the largest to-date against a single entity, is a result of the extent and duration of the alleged noncompliance (dating back to the inception of the Security Rule in some instances), the involvement of the State Attorney General in a corresponding investigation, and the large number of individuals whose information was affected by Advocate, one of the largest health systems in the country.”
Advocate failed to:
- conduct an accurate and thorough assessment of the potential risks and vulnerabilities to all of its ePHI
- implement policies and procedures and facility access controls to limit physical access to the electronic information systems housed within a large data support center
- obtain satisfactory assurances in the form of a written business associate contract that its business associate would appropriately safeguard all ePHI in its possession
- reasonably safeguard an unencrypted laptop when left in an unlocked vehicle overnight.
Take Away:
“We hope this settlement sends a strong message to covered entities that they must engage in a comprehensive risk analysis and risk management to ensure that individuals’ ePHI is secure,” said OCR Director Jocelyn Samuels. “This includes implementing physical, technical, and administrative security measures sufficient to reduce the risks to ePHI in all physical locations and on all portable devices to a reasonable and appropriate level.”
Whether you’re a single doctor practice or a medical network, it’s highly likely you will suffer a breach. When you do, you will be audited. It’s cheaper to work on being HIPAA compliant before the breach and audit instead of after when you will have to do the work and pay the fine.