The Office of Civil Rights (OCR) of the U.S. Department of Health and Human Services (HHS) has reached a settlement with a medical provider concerning a Health Insurance Portability and Accountability Act (HIPAA) violation. The violation at issue, which resulted in a fine of more than $35,000, involved improper disclosure of protected health information (PHI).
OCR initiated an investigation after a patient reported that the covered entity had improperly disclosed information related to her reproductive health to a prospective employer. The PHI disclosure occurred when the patient asked the provider to send a copy of a specific test result to the prospective employer. Instead, the provider disclosed her entire medical record without authorization.
The covered entity agreed to a two-year corrective action plan and a monetary fine. The plan requires the covered entity to:
- Submit a breach notification report to HHS concerning any such incidents.
- Review, develop, or revise privacy policies and procedures to be approved by OCR and distributed to all employees with certification they have received the documents.
- Train all employees on policies and procedures, including any employees of affiliated entities.
- Submit a written report updating HHS on implementing the corrective action plan.
- Provide OCR annual reports regarding noncompliance with the approved policies and procedures.
