Case Study #73
Agape Health Services
$25,000
July 23, 2020
Trigger
- In North Carolina, there is a small Federally Qualified Health Clinic
- Somebody accidentally sent a list of patients to the wrong email address
- Investigation finds that the clinic had basically no HIPAA compliance program
Key Highlights
A few snippets from case documents
Legend
HIPAA Police are variously referred to as "OCR", "HHS-OCR" or just "HHS"
Patient Data is called "ePHI" or "PHI" or electronic Protected Health Information
HIPAA Rules are written in the "C.F.R." or Code of Federal Regulations
Hospitals, insurers, pharmacies, practices, labs, associates.. who must obey HIPAA are called "Covered Enitites"
HIPAA Rules that have been violated are called "Covered Conduct"
Chief of the HIPAA Police is usually called "OCR Director"
Comments & Questions
- Another old case where the initial breach was back in 2011
- Why was HHS-OCR reaching back to these old breach reports?This is a small clinic serving the poor with no insurance - speculating that the message is every healthcare team has to get their act together
- quote: "OCR's investigation revealed longstanding, systemic noncompliance with the HIPAA Security Rule. Specifically, Metro failed to conduct any risk analyses, failed to implement any HIPAA Security Rule policies and procedures, and neglected to provide workforce members with security awareness training until 2016."
- Making sense of the fine amount:$25,000 / 1,263 patients records exposed = $19.79 each
- I think that $25k is the lowest fine amount for not protecting Patient Data- four location FQHC in a rural area is the smallest-of-the-small - these patients have nowhere else to turn - clinicians work here because of the 'mission' - I think the message is that nobody is too small - you must have a HIPAA compliance program Email me with comments
Lessons
- Conduct a risk assessment
- Document policies and procedures
- Provide basic HIPAA training
- quote: "Health care providers owe it to their patients to comply with the HIPAA Rules. When informed of potential HIPAA violations, providers owe it to their patients to quickly address problem areas to safeguard individuals' health information," said Roger Severino, OCR Director
- These cases drag on for years -it started June 2011; was settled July 2020; then Agape was on probation for 2 years
- One of the jobs of the the HIPAA Specialist is to documentthe policies and procedures for things like conducting a risk assessment
- If it isn't documented, then it didn't happen- I recommend a HIPAA Notebook
- Talk about HIPAA policies and procedures at the monthly team meeting
Keyword Tags
- Protect Patient Data
- Encryption
- HIPAA Specialist
- Risk Assessment
- Business Associate Agreement
- Employee Training
- Documentation
- Computer Equipment
- Policies & Procedures
- Internet App
- Small Medical Practice
- Health Provider
- Visible On Internet
- Patient Data Transfer
- North Carolina
- 2020