nurse hipaa violation cases

Lahey Hospital and Medical Center has agreed to pay $850,000 to settle the case without admission of liability. In fact, even a competent healthcare facility will experience minor HIPAA violation cases at some point. The above penalties were implemented as demanded by the HITECH Act of 2009 and increase annually in line with inflation. St. Lukes-Roosevelt Hospital Center Inc. has paid OCR $387,200 to resolve potential HIPAA violations discovered during an OCR investigation of a complaint about an impermissible disclosure of PHI. The case was settled for $202,400. Case Examples. The case was settled with OCR for $30,000. The minimum fines are $100 per violation for tier 1, $1,000 per violation for tier 2, $10,000 per violation for tier 3, and $50,000 per violation for tier 4. A contested hearing took place, and the board found the nurse: The 2020 increase is largely due to OCRs HIPAA Right of Access enforcement initiative, which was launched in late 2019. Toll Free Call Center: 1-800-368-1019 The Paubox team exported all reported incidents from HHS's official Breach Portal from January 1, 2019 - December 31, 2019 and used the data to compile the following summary. Read More, The Department of Health and Human Services Office for Civil Rights announced yesterday that the University of Mississippi Medical Center (UMMC) has agreed to settle alleged HIPAA violations and will pay a financial penalty of $2.75 million. Read More, OCR investigated a complaint about an impermissible disclosure of a patients PHI to a reporter. The nonprofit teaching hospital has also agreed to adopt the OCRs corrective action plan to address HIPAA-compliance issues discovered by OCR investigators. Detailed below is a summary of all HIPAA violation cases that have resulted in settlements with the Department of Health and Human Services Office for Civil Rights (OCR), including cases that have been pursued by OCR after potential HIPAA violations were discovered during data breach investigations, and investigations of complaints submitted by patients and healthcare employees. Read More, The HHS has announced that Lahey Hospital and Medical Center has agreed to settle a case with the Office for Civil Rights over alleged HIPAA violations following a data breach that occurred in October 2011. Read More, Following the report of the theft of a laptop from the Springfield Missouri Physical Therapy Center, Concentra Health Services was subjected to an investigation by the OCR. Read more, Arbour Hospital, a mental health clinic in Boston, MA, failed to provide a patient with the requested medical records within 30 days. Among the corrective actions required to resolve this case, OCR required the insurer to correct the flaw in its computer system, review all transactions for a six month period and correct all corrupted patient information. A hospital employee's supervisor accessed, examined, and disclosed an employee's medical record. Issue: Safeguards, Minimum Necessary. Read More, The Californian general dental practice, New Vision Dental, was investigated by OCR following reports about impermissible disclosures of patients protected health information on the review platform Yelp. In 2012 it suffered a security breach that exposed the data of 2,700 individuals as a result of a malware infection. OCR determined the lack of encryption was in violation of the HIPAA Security Rule, there were insufficient device and media controls, and a business associate agreement had not been entered into with its parent company. The case was settled for $3,500. Read more, In 2015, Excellus Health Plan reported a breach of the ePHI of 9,358,891 individuals. Read More, Complete P.T., Pool & Land Physical Therapy, Inc., (CPT) has agreed to pay a fine of $25,000 to the Department of Health and Human Services after the company posted photographs and names of patients on the client testimonial section of its website without first having obtained HIPAA-compliant authorizations from the patients in question. The directory contained files that included the protected health information (PHI) of 307,839 individuals. The penalties for HIPAA violations through the OCR are as follows: Tier 1: Minimum fine of $100 per violation, up to $50,000 Tier 2: Minimum fine of $1,000 per violation, up to $50,000 Tier 3: Minimum fine of $10,000 per violation, up to $50,000 Tier 4: Minimum fine of $50,000 per violation The employee responsible for the disclosure received a written disciplinary warning, and both the employee and the physician apologized to the patient. To resolve this matter, OCR also required the practice to revise its policies and operating procedures and to move medical alert stickers to the inside cover of the records. Covered Entity: Private Practice Read More, Bayfront Health St. Petersburg was investigated following receipt of a complaint from a patient on August 14, 2018. The case was settled for $15,000. Mental Health Center Provides Access after Denial 2021 HIPAA Right of Access Enforcement Actions Other 2021 HIPAA Violation Penalties A complaint alleged that an HMO impermissibly disclosed a members PHI, when it sent her entire medical record to a disability insurance company without her authorization. Read more, Childrens Hospital & Medical Center (CHMC), a pediatric care provider in Omaha, Nebraska, received a request from a parent for access to her daughters medical records but only provided part of the requested information, despite repeated requests. Read More, On May 9, 2014, Touchstone Medical Imaging was informed by the FBI that one of its FTP servers was accessible over the Internet and allowed anonymous connections to a shared directory. Documentation was uncovered that clearly showed that mobile devices were believed to represent a critical security risk, yet action was not taken to address this issue in time to prevent the data breach. Covered Entity: Pharmacies To avoid these, a proactive approach should include a regular risk assessment and corrective action plan. The case was settled for $6,850,000. They split the fines and charges into two categories: reasonable cause and willful neglect. Dr. Glazer did not cooperate with OCR during the investigation, resulting in OCR imposing a civil monetary penalty of $100,000 for the HIPAA Right of Access violation. CHMC settled the HIPAA Right of Access case with OCR and paid an $80,000 penalty. Read More, Memorial Hermann Health System in Texas received five requests from a patient for complete records to be provided between June 2019 and January 2020. OCR investigated and found multiple potential HIPAA violations such as the failure to conduct a thorough risk analysis, risk management failures, and insufficient mechanisms to identify suspicious network activity. Read More, The Department of Health and Human Services Office for Civil Rights announced a new HIPAA settlement to resolve violations of the HIPAA Privacy Rule. Issue: Impermissible Disclosure-Research. In addition, OCR determined there had been risk analysis failures, a risk management failure, and a lack of device media controls. In 2013 and 2015, protections on servers were accidentally removed and files containing ePHI could be accessed over the internet without the need for a username or password. OCR also discovered a business associate failure. 3 Examples of HIPAA Violation Cases Example #1: When it comes to HIPAA, curiosity can kill the cat or your career. Covered Entity: Health Plans in Chicago, Illinois, was investigated in response to a complaint from a patient who had only been provided with a partial copy of her requested medical records. An employee of a major health insurer impermissibly disclosed the protected health information of one of its members without following the insurer's authorization and verification procedures. The investigation confirmed there had been a HIPAA Right of Access failure. The private practice maintained that the disclosure to the contract research organization was permissible as a review preparatory to research. The penalties for a HIPAA violation are determined by the CE; HIPAA itself does not explicitly state what types of HIPAA violations will and will not result in the loss of a job. The HHS` Office of Civil Rights receives between 1,200 and 1,500 complaints and notifications of breaches per year. jQuery( document ).ready(function($) { The Privacy Rule requires covered entities to provide individuals with access to their medical records; however, the Privacy Rule exempts psychotherapy notes from this requirement. Read More, The Department of Health and Human Services Office for Civil Rights (OCR) has fined New York Presbyterian Hospital (NYP) $2.2 million for allowing patients to be filmed for a TV show without obtaining prior permission from patients. In April, nurses on the night shift at Denver Health Medical Center were caught making inappropriate comments about a male patient's genitalia, according to a report from the Colorado Department. So-mogye v. Toledo Clinic, 2012 WL 2191279 (N.D. Ohio, June 14, 2012). However, the investigation revealed that the pharmacy chain and the law firm had not entered into a Business Associate Agreement, as required by the Privacy Rule to ensure that PHI is appropriately safeguarded. Washington, D.C. 20201 Toll Free Call Center: 1-800-368-1019 0:57. OCR determined this violated the HIPAA Right of Access provision of the HIPAA Privacy Rule. The PHI of 58,106 patients was improperly disposed of during that timeframe. A nurse in a New York clinic found herself at the center of an ugly HIPAA violation case when her sister-in-law's boyfriend was diagnosed with an STD. Read More, After the permanent closure of the company, paperwork containing former patients PHI was discarded by FileFax. Delivered via email so please ensure you enter your email address correctly. The local newspaper then featured on its front page the individuals x-ray and an article that included the date of the accident, the location of the accident, the patients gender, a description of patients medical condition, and numerous quotes from the hospital about such unusual sporting accidents. OCR provided technical assistance to the physician, explaining that, in general, the Privacy Rule requires that a covered entity provide an individual access to their medical record within 30 days of a request, regardless of whether or not the individual has a balance due. Employees also were trained to review registration information for patient contact directives regarding leaving messages. The. University of Texas MD Anderson Cancer Center was ordered to pay a civil monetary penalty of $4,348,000. Read More, The Department of Health and Human Services Office for Civil Rights has sent another warning to HIPAA-covered entities about the need to obtain signed, HIPAA-compliant business associate agreements with all vendors prior to disclosing any protected health information. The impermissible disclosures of PHI resulted in a $10,000 settlement. If an organization fails to take corrective action after having been issued a fine, the HHS Office of Civil Rights can impose subsequent fines. OCR attempted to resolve the matter via informal means between November 6, 2015, to August 30, 2016, before issuing a Notice of Proposed Determination on September 30, 2016. Read More, The Department of Health and Human Services Office for Civil Rights (OCR) imposed a $1.6 million civil monetary penalty (CMP) on Texas Health and Human Services Commission (TX HHSC) for multiple violations of HIPAA Rules discovered during the investigation of an exposed internal application containing ePHI. HIPAA Advice, Email Never Shared Read More, CHSPSC LLC isa Tennessee-based management companythat provides services to affiliates of Community Health Systems. 164.308(a)(1)(ii)(B). I personally would not expect a student to fully understand these things; correction and education would be in order rather than exaggerating the offenses to the level of HIPAA violation. Boston Medical Center agreed to settle the alleged HIPAA violations with OCR for $100,000. Improper Disposal HIPAA rules state medical professionals must dispose of PHI in a secure manner. 6) Keep Thoughts to Yourself. It took 8 months from the date of the first request for the records to be provided. While the amendment provisions of the Privacy Rule permit a covered entity to deny an individual's request for an amendment when the covered entity did not create that the portion of the record subject to the request for amendment, no similar provision limits individuals' rights to access their protected health information. Read More, A patient of University of Cincinnati Medical Center filed a complaint with OCR after not being provided with her requested records more than 13 weeks after submitting a request. The case was settled for $62,500. Settlements have previously been agreed upon with healthcare providers, health plans, and business associates of covered entities, but this is the first time OCR has settled potential HIPAA violations with a wireless health services provider. Under the revised policies and procedures, the practice may use and disclose PHI for research purposes, including recruitment, only if a valid authorization is obtained from each individual or if the covered entity obtains documentation that an alteration to or a waiver of the authorization requirement has been approved by an IRB or a Privacy Board. Additionally, in order to prevent similar incidents, the hospital undertook a complete review of the distribution of the OR schedule. Read more, The owner of the Fairhope, AL, dental practice impermissibly disclosed patients PHI to a campaign manager and a third-party marketing company in relation to a state senate election campaign. OCR settled the case for $65,000. In 2015, Premera discovered there had been a breach of the ePHI of 10,466,692 individuals. Health Plan Corrects Impermissible Disclosure of PHI through Training, Mitigation, and Sanctions An organizations willingness to assist with an investigation is also taken into account. OCR intervened and provided technical assistance on the HIPAA Right of Access but received a second complaint when the practice continued to deny him access. HIPAA Journal's goal is to assist HIPAA-covered entities achieve and maintain compliance with state and federal regulations governing the use, storage and disclosure of PHI and PII. Now add up that time for a week, a month, or even a year. The chain acknowledged that log books contained protected health information and implemented the required changes. Among other steps to resolve the specific issue in this case, OCR required the private practice to revise its access policy and procedures to affirm that, consistent with the Privacy Rule standards, patients have access to their record regardless of whether another entity created information contained within it. > Case Examples Among other corrective actions to resolve the specific issues in the case, the HMO created a new HIPAA-compliant authorization form and implemented a new policy that directs staff to obtain patient signatures on these forms before responding to any disclosure requests, even if patients bring in their own authorization form. OCR determined there had been risk analysis failures, insufficient reviews of system activity, a failure to respond adequately to a detected breach, and insufficient technical controls to prevent unauthorized ePHI access. All staff was trained on the revised procedures. Issue: Access. Health Sciences Center Revises Process to Prevent Unauthorized Disclosures to Employers UMMC has also agreed to adopt a corrective action plan (CAP) to bring privacy and security standards up to the level required by HIPAA. Mental Health Center Corrects Process for Providing Notice of Privacy Practices A nurse practitioner who has privileges at a multi-hospital health care system and who is part of the systems organized health care arrangement impermissibly accessed the medical records of her ex-husband. The following three years saw similar numbers of financial penalties; however, there was another major increase in HIPAA fines in 2020 when 19 HIPAA violation cases were settled with OCR. However, the court also legitimized private cause for action in HIPAA lawsuits, which could set a precedent for HIPAA related legal action. Read more, Wake Health Medical Group, a Raleigh, NC-based provider of primary care and other health care services, failed to provide a patient with timely access to the requested medical records. Private Practice Provides Access to All Records, Regardless of Source Read more, Renown Health, a not-for-profit healthcare network in Northern Nevada, failed to provide a patients attorney with a copy of her medical and billing records within 30 days. The HIPAA Right of Access violation was settled with OCR for $30,000. OCR settled the case for $20,000. A settlement was agreed upon with OCR that included a $25,000 penalty. The failure to cooperate with the investigation and respond to an administrative subpoena resulted in a civil monetary penalty of $50,000. Five former Methodist employees have been indicted on charges . Read more, The Diabetes, Endocrinology & Lipidology Center, Inc, a West Virginia-based healthcare provider specializing in treating endocrine disorders, failed to provide a parent with a copy of her minor childs protected health information within 30 days. Covered Entity: Private Practice Read More, Lifespan Health System Affiliated Covered Entity is a Rhode Island healthcare provider. Read More, OCR fined Pagosa Springs Medical Center $111,400 for the failure to terminate a former employees access to a web-based scheduling calendar, which resulted in an impermissible disclosure of 557 patients ePHI. The Center provided OCR with a valid authorization, signed by the complainant, permitting the release of information to the auto insurance company. Read More, Presence Health, one of the largest healthcare networks serving residents of Illinois, has agreed to pay OCR $475,000 to settle potential HIPAA Breach Notification Rule violations. Read More, Danbury Psychiatric Consultants in Massachusetts received a request for medical records on March 24, 2020, but access to the records was refused due to an outstanding bill. The records were provided within days of OCR intervening. A good example of this is a laptop that is stolen. Taking this into account, the figures OCR is working with are detailed in the table below and will apply indefinitely, until the next increase to account for inflation. OCR provided technical assistance to the covered entity, explaining that the Privacy Rule permits a covered entity to provide a summary of patient records rather than the full record only if the requesting individual agrees in advance to such a summary or explanation. MAPFRE has agreed to a $2,200,000 settlement with OCR. Read More, In March 2019, OCR received a complaint from a patient who alleged she had not been provided with a copy of her medical records in the requested electronic format despite making repeated requests. Case Examples by Issue. An OCR investigation indicated that the form the HMO relied on to make the disclosure was not a valid authorization under the Privacy Rule. Read More, OCR announced that it has reached a settlement for $125,000 with a Denver-based healthcare provider, Cornell Pharmacy, following the improper disposal of patient health records. The case was settled for $850,000. Metro Community Provider Network (MCPN) has agreed to pay OCR $400,000 and adopt a robust corrective action plan to resolve all HIPAA compliance issues identified during the OCR investigation. Covered Entity: Health Plans The investigation also indicated that the disclosures did not meet the Rules de-identification standard and therefore were not permissible without the individuals authorization. At the direction of an insurance company that had requested an independent medical exam of an individual, a private medical practice denied the individual a copy of the medical records. Private Practice Revises Policies and Procedures Addressing Activities Preparatory to Research OCR also identified issues with the notice of privacy practices and a HIPAA privacy officer had not been appointed. Another potential HIPAA violation that's easily overlooked is discussing information over the phone. A violation of HIPAA attributable to ignorance can attract a fine of $100 - $50,000. Read More, Southwest Surgical Associates in Texas took 13 months to provide a patient with all of the requested records between February 11, 2020, and March 5, 2021. OCR intervened and closed the case but received a second complaint a month later when the records had still not been provided. In nursing education, a HIPAA violation made by a nursing student could result in a variety of disciplinary actions including termination but is rarely discussed in nursing literature. "HIPAA applies to schools.". And when data breaches like this occur, it's usually because of a HIPAA violation. The hospital asserted that the disclosures were made to avert a serious threat to health or safety; however, OCRs investigation indicated that the disclosures did not meet the Privacy Rules standard for such actions. While the Privacy Rule may permit the disclosure of an OR schedule containing PHI, in this case, a hospital employee shared the OR scheduled with the complainants supervisor, who was not part of the employee's treatment team, and did not need the information for payment, health care operations, or other permissible purposes. Nurse Pleads Guilty to HIPAA Violation A licensed practical nurse who pled guilty to wrongfully disclosing a patient's health information for personal gain faces a maximum penalty of 10 years imprisonment, a $250,000 fine or both. Comments and replies to someone else's post, chat room gossip (even if it's a private room) or leaving a review on a site like Yelp opens the door for potential HIPAA violations. Issue: Impermissible Uses and Disclosures; Authorizations. The data breach investigation revealed a substandard security management process and a catalog of HIPAA Security Rule violations. Covered Entity: Health Care Provider A state health sciences center disclosed protected health information to a complainant's employer without authorization. OCR provided technical assistance and closed the case, but the records were still not provided. The case was settled for $3 million. A hospital employee did not observe minimum necessary requirements when she left a telephone message with the daughter of a patient that detailed both her medical condition and treatment plan. OCR received a complaint from a patient who alleged AIMS refused to give her a copy of her medical records. Between October 23, 2009, and March 7, 2010 part of its database of policyholders was accessible to unauthorized individuals. Covered Entity: Health Plans / HMOs HMORevises Process to Obtain Valid Authorizations Criminal violations of HIPAA Rules are dealt with by the U.S. Department of Justice. OCR Imposes a $2.15 Million Civil Money Penalty against Jackson Health System for HIPAA Violations - October 23, 2019 Dental Practice Pays $10,000 to Settle Social Media Disclosures of Patients' Protected Health Information - October 2, 2019 OCR Settles First Case in HIPAA Right of Access Initiative - September 9, 2019