The HHSC and OCR announced their first case involving big fine ($50,000) for a breach of less than 500 patients. A laptop containing 441 patients' information was stolen in 2010 from Hospice of North Idaho (HONI).
Laptops containing ePHI are regularly used by the organization as part of their field work. Over the course of the investigation, OCR discovered that HONI had not conducted a risk analysis to safeguard ePHI. Further, HONI did not have in place policies or procedures to address mobile device security as required by the HIPAA Security Rule. Since the June 2010 theft, HONI has taken extensive additional steps to improve their HIPAA Privacy and Security compliance program.
“This action sends a strong message to the health care industry that, regardless of size, covered entities must take action and will be held accountable for safeguarding their patients’ health information.” said OCR Director Leon Rodriguez. “Encryption is an easy method for making lost information unusable, unreadable and undecipherable.”
Breaches of more than 500 patients must be reported to HHSC and the media immediately. However, breaches involving less than 500 patients are reported on a regular basis.
A new educational initiative, Mobile Devices: Know the RISKS. Take the STEPS. PROTECT and SECURE Health Information, has been launched by OCR and the HHS Office of the National Coordinator for Health Information Technology (ONC) that offers health care providers and organizations practical tips on ways to protect their patients’ health information when using mobile devices such as laptops, tablets, and smartphones. For more information, visit www.HealthIT.gov/mobiledevices.
Check out the link above or contact our office for more information on how to conduct a Risk Assessment and what you need to do to protect your patient data! Keep watch over those mobile devices. This also goes for those of you bringing home CDs of back up data from your network….