• Oklahoma State University trains clinical students, cares for patients and conducts research
• The school's website got hacked
• The school's IT department was not aware that some folders on the web server contained patient data
• Investigation finds that Oklahoma had not done an enterprise wide risk assessment

---

• Minor note 1: a new Director of HHS-OCR took over - this is thefirst case
• Minor note 2: the case's legal documents changed format and theyare less verbose
• Minor note 3: these cases are now getting into theCovid period - there was a long time between the last case (Jan 2021) and this case (July 2022) - I assume that Covid changed the cadence of these cases
• This case is yet another university getting a big HIPAA fine
• Technical note: there are different parts to an IT system - the web server hosts Oklahoma's website - whereas their electronic health record (EHR) would probably be on a different server with a separate database - IT architects would not normally design the system such that patient data is on a web server
• quote: "an unauthorized third party gained access to a web server that contained electronic protected health information"
• Making sense of the fine amount:$875,000 / 279,865 patients records exposed = $3.13 each
• How did the patient data get on the web server? Was it for research? Was it a backup copy? When computer systems are in short supply, sometimes people get desperate to store things on any drive with extra space. Send me an email if you know bert@clinicnerds.com

• Conduct an enterprise wide risk analysis
• An enterprise wide risk assessment mean that you have a map (or diagram) of all your IT systems and you know what is on each server
• It is essential to monitor activity logs andreview system activity reports
• I refer to anything with Patient Data as a PHI Hotspot - you should have a list of all your PHI Hotspots
• quote: “HIPAA covered entities are vulnerable to cyber-attackers if they fail to understand where ePHI is stored in their information systems,” said OCR Director Lisa J. Pino.
• These cases drag on for years -it started Mar 2016; was settled Jul 2022; then Oklahoma was on probation for 2 years
• One of the jobs of the the HIPAA Specialist is to documentthe policies and procedures for things like enterprise wide risk assessment
• If it isn't documented, then it didn't happen- I recommend a HIPAA Notebook
• Talk about HIPAA policies and procedures at the monthly team meeting

• Protect Patient Data
• HIPAA Specialist
• Risk Assessment
• Employee Training
• Computer Equipment
• Policies & Procedures
• Breach Notification
• Stolen
• Internet App
• Firewall
• Computer Virus/Malware/Hack
• University
• Health Provider
• Malicious
• Monthly Reviews
• Audit Trail Reports
• Oklahoma
• 2022

---