Case Study #19
QCA
$250,000
April 22, 2014
Trigger
- An employee has a laptop with Patient Data
- The laptop is left in the car and stolen
- After the breach, the company decided to encrypt all of their computers
Key Highlights
A few snippets from case documents
Legend
HIPAA Police are variously referred to as "OCR", "HHS-OCR" or just "HHS"
Patient Data is called "ePHI" or "PHI" or electronic Protected Health Information
HIPAA Rules are written in the "C.F.R." or Code of Federal Regulations
Hospitals, insurers, pharmacies, practices, labs, associates.. who must obey HIPAA are called "Covered Enitites"
HIPAA Rules that have been violated are called "Covered Conduct"
Chief of the HIPAA Police is usually called "OCR Director"
Comments & Questions
- The names change but the details are the same:unencrypted laptop stolen
- Interesting that there were just 148 patient records onthe laptop yet the fine was $250k - the following quote might hint that the reason - after a breach, probably not unusual for an org to act as compliant as possible
- quote: "While QCA encrypted their devices following discovery of the breach..."
- This next quote is also interesting - sounds like they were lighton employee training and documentation - this is why I recommend a HIPAA Notebook and certification course
- quote: "QCA is also required to retrain its workforce and document its ongoing compliance efforts."
Lessons
- Encrypt all computers
- quote: “Our message to these organizations is simple: encryption is your best defense against these incidents.” Susan McAndrew, OCR’s deputy director of health information privacy
- Have a documented policy about employees taking Patient Dataoutside of the office
- These cases drag on for years - the laptop was stolen October 2011;this agreement was signed April 2014; then QCA was on probation for 3 years
- One of the jobs of the the HIPAA Specialist is to documentthe policies and procedures for things like encrypted computers
- If it isn't documented, then it didn't happen- I recommend a HIPAA Notebook
- Talk about HIPAA policies and procedures at the monthly team meeting
Keyword Tags
- Protect Patient Data
- Encryption
- HIPAA Specialist
- Risk Assessment
- Employee Training
- Documentation
- Computer Equipment
- Policies & Procedures
- Laptop
- Stolen
- Stolen From Car
- Health Insurer
- Outside the Office
- Arkansas
- 2014