• Memorial Hospital has some employees at a local clinic - they get new jobs
• Somebody forgot to turn off their User ID access to the medical record system
• The former employees collect Patient Data and illegally sell it

---

• This was the biggest fine to date
• If you are a big-enterprise-healthcare-system then you need toallocate big resources to monitor the security of it
• quote: "MHS is a nonprofit corporation which operates six hospitals, an urgent care center, a nursing home, and a variety of ancillary health care facilities throughout the South Florida area. MHS is also affiliated with physician offices through an Organized Health Care Arrangement (OHCA)"
• HIPAA is hard - these were former employees of a small satellite locationyet they had access to the computer systems at headquarters - they essentially attacked a small remote location with weak security
• "federal charges" - people might have gone to jail in this case
• quote: "Some of these instances led to federal charges relating to selling protected health information (PHI) and filing fraudulent tax returns."
• Making sense of the fine amount:$5.5m / 115,143 patients records exposed = ~$47.77 each
• Your IT vendors and IT department should automate audit trail reportsso that they can be easily skimmed to look for abnormalities - good IT support will implement algorithms/models to highlight unusual activity - like a bank flagging weird charges on your credit card
• I use this saying: "HIPAA is not a one time event - it is ongoing" -this case is an example of how it is ongoing - you need to check audit trail reports at least monthly - weekly is better - these former employees were accessing the system daily for over a year

• Regularly review the people who are accessing your Patient Data
• Regularly review the audit trail logs of Patient Data access
• quote: “Further, organizations must implement audit controls and review audit logs regularly. As this case shows, a lack of access controls and regular review of audit logs helps hackers or malevolent insiders to cover their electronic tracks, making it difficult for covered entities and business associates to not only recover from breaches, but to prevent them before they happen" Robinsue Frohboese, Acting Director, HHS-OCR
• Revoke User IDs before you finish saying goodbye to employeeswho are leaving your healthcare team
• quote: "Although it had workforce access policies and procedures in place, MHS failed to implement procedures with respect to reviewing, modifying and/or terminating users’ right of access, as required by the HIPAA Rules"
• These cases drag on for years -it started April 2011; was settled Feb 2017; then Memorial Health was on probation for 3 years
• One of the jobs of the the HIPAA Specialist is to documentthe policies and procedures for things like disabling User IDs
• If it isn't documented, then it didn't happen- I recommend a HIPAA Notebook
• Talk about HIPAA policies and procedures at the monthly team meeting

• Protect Patient Data
• HIPAA Specialist
• Risk Assessment
• Employee Training
• Computer Equipment
• Policies & Procedures
• Stolen
• Large Organization
• Health Provider
• Over $1m
• Malicious
• Joint Investigation
• Monthly Reviews
• Audit Trail Reports
• User Authentication
• Former Employee
• Exit Interview
• Florida
• 2017

---