Case Study #85
MedEvolve
$350,000
May 5, 2023
Trigger
- MedEvolve is a back office software/service provider to healthcare practices
- A file server (FTP) that contained Patient Data was misconfigured to allow access from the internet
- Investigation found that MedEvolve had an incomplete risk assessment and missing Business Associate Agreements
Key Highlights
A few snippets from case documents
Legend
HIPAA Police are variously referred to as "OCR", "HHS-OCR" or just "HHS"
Patient Data is called "ePHI" or "PHI" or electronic Protected Health Information
HIPAA Rules are written in the "C.F.R." or Code of Federal Regulations
Hospitals, insurers, pharmacies, practices, labs, associates.. who must obey HIPAA are called "Covered Enitites"
HIPAA Rules that have been violated are called "Covered Conduct"
Chief of the HIPAA Police is usually called "OCR Director"
Comments & Questions
- Businesses needs to send large computer files to each other - files that are too big for email attachments - FTP (file) servers allow for transferring large files but due to security/privacy issues has largely been replaced by SSH
- MedEvolve does back office (revenue cycle) work for medical practices - so it makes sense that they need to transfer large files
- I'm speculating here, but the FTP server was probablyaccidentally changed (configuration change) which allowed it to be accessible to the internet without logging in
- This was NOT a cyber-attack or a hacking incident - thiswas just a mistake by somebody in IT
- quote: OCR Director Melanie Fontes Rainer: “HIPAA regulated entities must ensure that they are not leaving patient health information unsecured on network servers available to the public via the internet.”
- Sort of surprising that they did not have the signedBusiness Associates Agreements in place:
- quote: "MedEvolve failed to enter into a business associate agreement with a subcontractor."
- Making sense of the fine amount:$350,000 / 230,572 patients records exposed = $1.52 each
- MedEvolve is a subcontractor (Business Associate) of a couple medical practices - note that it was the medical practices' patients whose data was compromised - the medical practices had to tell their patients about the breach - probably not good for business - Send me an email with your thoughts bert@clinicnerds.com
Lessons
- Conduct and document a thorough enterprise wide risk assessment
- Implement regular reviews of audit trail reports andsystem activity reports
- quote: "As part of this process, MedEvolve shall include a complete inventory of all electronic equipment, data systems, off-site data storage facilities, and applications that contain or store ePHI which will then be incorporated in its risk analysis."
- These cases drag on for years -it started Jul 2018; was settled May 2023; then MedEvolve was on probation for 2 years
- One of the jobs of the the HIPAA Specialist is to documentan enterprise-wide risk assessment
- If it isn't documented, then it didn't happen- I recommend a HIPAA Notebook
- Talk about HIPAA policies and procedures at the monthly team meeting
Keyword Tags
- Protect Patient Data
- Encryption
- HIPAA Specialist
- Risk Assessment
- Business Associate Agreement
- Employee Training
- Documentation
- Computer Equipment
- Policies & Procedures
- Internet App
- Configuration Change
- Small Medical Practice
- Health Provider
- Visible On Internet
- Audit Trail Reports
- Subcontractor
- Patient Data Transfer
- Business Associate
- Arkansas
- 2023