Case Study #74

Lifespan

$1,040,000

July 27, 2020

Trigger

Key Highlights

A few snippets from case documents

Legend

HIPAA Police are variously referred to as "OCR", "HHS-OCR" or just "HHS"

Patient Data is called "ePHI" or "PHI" or electronic Protected Health Information

HIPAA Rules are written in the "C.F.R." or Code of Federal Regulations

Hospitals, insurers, pharmacies, practices, labs, associates.. who must obey HIPAA are called "Covered Enitites"

HIPAA Rules that have been violated are called "Covered Conduct"

Chief of the HIPAA Police is usually called "OCR Director"

Comments & Questions

You need to have a policy about whether employees are allowed touse their personal devices for work purposes
You need to have a policy that states employees are not allowedto ever leave any mobile device in the car
You need to have a list of every person & thing which hasaccess to your email system
quote: "...a Rhode Island Hospital employee's car was broken into while it was parked in a public lot. One of the items stolen was a Mac Book laptop used by the employee for work purposes. The laptop was never recovered. Lifespan ascertained that the employee's work emails may have been cached in a file on the device's hard drive."
Making sense of the fine amount:$1.04m / 20,431 patients records exposed = $50.90 each
At this point, HHS-OCR seems to be going after 'systemic noncompliance' -have notice word 'systemic' appearing lately:
quote: "OCR’s investigation determined that there was systemic noncompliance with the HIPAA Rules including a failure to encrypt ePHI on laptops"
Lifespan has a complicated business structure - Lifespan Corp vs Lifespance ACE -with subsidiaries that have the same/similar name - I wonder if these close-but-legally-different-business-entities cause people to overlook the need for a Business Associate Agreement - they may even work in the same office so I can see how it gets overlooked - I need a BAA with the guy in the cubicle next to me?!? Pure speculation - Email me with your comments

Lessons

Encrypt all computers
Conduct a risk assessment
Sign Business Associate Agreements
quote: “Laptops, cellphones, and other mobile devices are stolen every day, that’s the hard reality. Covered entities can best protect their patients’ data by encrypting mobile devices to thwart identity thieves,” said Roger Severino, OCR Director
These cases drag on for years -it started Feb 2017; was settled July 2020; then Lifespan was on probation for 2 years
One of the jobs of the the HIPAA Specialist is to documentthe policies and procedures for things like encrypting all computers
If it isn't documented, then it didn't happen- I recommend a HIPAA Notebook
Talk about HIPAA policies and procedures at the monthly team meeting

Keyword Tags