HIPAA Case Study #54 Filefax Feb. 13, 2018

Case Study #54

Filefax

$100,000

Feb. 13, 2018

Trigger

Filefax was a company that specialized in transport and storage of medical records
Filefax was going out of business
Dumpster divers get hold of Filefax's medical records and tries to recycle them for money

Key Highlights

A few snippets from case documents

Legend

HIPAA Police are variously referred to as "OCR", "HHS-OCR" or just "HHS"

Patient Data is called "ePHI" or "PHI" or electronic Protected Health Information

HIPAA Rules are written in the "C.F.R." or Code of Federal Regulations

Hospitals, insurers, pharmacies, practices, labs, associates.. who must obey HIPAA are called "Covered Enitites"

HIPAA Rules that have been violated are called "Covered Conduct"

Chief of the HIPAA Police is usually called "OCR Director"

Comments & Questions

This case is linked to case #48 Center for Children’s Digestive Health- the HIPAA Police followed the chain - who was this failing-document-shredding-company working for - then they asked if they had a signed and dated BAA - they didn't $31k for a missing document
Filefax was going out of business - but HIPAA protects Patient Datafor decades after the death of the patient
quote: "Filefax is no longer in business. In 2016, a court in unrelated litigation appointed a receiver to liquidate its assets for distribution to creditors and others. In addition to a $100,000 monetary settlement, the receiver has agreed, on behalf of Filefax, to properly store and dispose of remaining medical records found at Filefax’s facility in compliance with HIPAA"
You gotta know your vendors/partners - and you got tomake sure that they are protecting your Patient Data
Making sense of the fine amount:$100,000 / 2,150 patients records exposed = $46.51 each
The HIPAA Police had to wait in line at the bankruptcy courtto get the $100k - so this calculation should not be used in a model
This headline is not hyperbole - it is 'ripped' from the legal document:
quote: "... a “dumpster diver” brought medical records obtained from Filefax to a shredding and recycling facility to exchange for cash."

Lessons

Patient Data has a lifecycle that ends with safe disposal/destruction
Lock your garbage
Buy and use a paper shredder
Keeps tabs on your business associates
You are responsible for the safe disposal of Patient Data
quote: “The careless handling of PHI is never acceptable,” said OCR Director Roger Severino. “Covered entities and business associates need to be aware that OCR is committed to enforcing HIPAA regardless of whether a covered entity is opening its doors or closing them. HIPAA still applies.”
These cases drag on for years -it started Feb 2015; was settled Feb 2018; then HHS-OCR had to work with a "court appointed receiver"
One of the jobs of the the HIPAA Specialist is to documentthe policies and procedures for things like disposal and keeping tabs on your business associates
If it isn't documented, then it didn't happen- I recommend a HIPAA Notebook
Talk about HIPAA policies and procedures at the monthly team meeting

Keyword Tags