The Office of Civil Rights (OCR), a division of the U.S. Department of Health and Human Services (HHS), has settled violations of the Health Insurance Portability and Accountability Act (HIPAA) for $700,000. The covered entity, which provides genetic testing and clinical genomics services, filed a breach report with OCR in March 2020 after a January 2020 phishing incident. That incident exposed the protected health information (PHI) of 225,370 individuals. The exposed PHI included names, addresses, dates of birth, Social Security or driver’s license numbers, financial information, and extensive medical information.
Following an investigation, OCR determined that the covered entity failed to comply with HIPAA in three ways:
Failure to conduct an accurate and thorough assessment of the risks and vulnerabilities affecting its electronic PHI (ePHI);
Failure to implement procedures to terminate access to ePHI after the end of a staff member's employment or other working arrangement, or when access was no longer appropriate, which allowed former or unauthorized users to continue to access systems with ePHI; and
Failure to assign unique names or numbers to identify and track users in electronic systems with ePHI, which helps organizations identify and monitor activity within those systems.
In addition to the $700,000 payment to OCR, the settlement requires the covered entity to implement a corrective action plan (CAP), which OCR will monitor for two years. The CAP requires the following actions:
Conduct an accurate and thorough risk analysis to determine the potential risks and vulnerabilities of its ePHI system;
Implement a risk management plan to address and mitigate identified security risks and vulnerabilities;
Develop, review, and revise (if needed) its current security rule policies and procedures to comply with HIPAA rules;
Implement unique user identification in all IT systems containing ePHI; and
Ensure all workforce members are trained on security rule policies and procedures.
This settlement emphasizes the potential repercussions of the common cyberattack of email phishing, i.e., PHI disclosure and HIPAA Security Rule failures. For effective cybersecurity and cyberdefense, companies should conduct a risk analysis, proactively manage risk, implement and regularly update security policies, train staff, and fully implement the HIPAA Security Rule. HIPAA covered entities must put these fundamental security protections in place in advance of, not in response to, a cyberattack.
HBL has experience in all areas of benefits and employment law, offering a comprehensive solution to all your business benefits and HR/employment needs. We help ensure you are in compliance with the complex requirements of ERISA and the IRS code, as well as those laws that impact you and your employees. Together, we reduce your exposure to potential legal or financial penalties. Learn more by calling 470-571-1007.
