The two previous settlements this year were both announced in February. The breach that triggered that settlement began with the theft of desktop computers that contained the PHI of 4 million patients ( RPP 9/16, p. OCR also found fault with MD Anderson’s encryption program-citing the fact that it had, as of January 2013, “reported to OCR that it had encrypted 98% of its total managed computer inventory (33,385 computers).”įor comparison, OCR’s largest settlement was for $5.55 million with Advocate Health Care of Illinois. MD Anderson’s lost devices at issue contained protected health information (PHI) for 33,500 individuals. MD Anderson’s $4.358 million penalty is the fourth biggest in OCR’s history and follows the agency’s pattern of increasingly high penalties for what may be relatively small numbers of affected patients. Arvin’s previous positions include chief compliance officer for the University of California Los Angeles Health and chief privacy officer for the University of Louisville. The solution consists of a comprehensive set of technologies and services. To help with an analysis of the MD Anderson situation, RPP consulted with Marti Arvin, vice president of audit strategies for the security consulting firm CynergisTek Inc. A myriad of regulations require an active auditing and monitoring program. MD Anderson’s situation is especially compelling for a variety of reasons, including the continuation of the case beyond the point where most are resolved. OCR always recommends that CEs and BAs examine settlements and other enforcement actions for lessons they can glean to keep them out of similar trouble. In June, OCR announced that an administrative law judge (ALJ) had sided with the agency and was imposing a $4.358 million penalty on the University of Texas MD Anderson Cancer Center for HIPAA violations ( RPP 7/18, p.

In contrast to 2017, the pace of OCR’s enforcement has slowed: by this time last year, the agency had announced nine of the 10 cases it would resolve by the start of 2018.īut what OCR may lack in volume, it has somewhat made up in intrigue, particularly with its most recent enforcement action. For the CEs, the penalties were in the millions, while the BA got off comparatively easily with just $100,000. The health system has also added CynergisTek. So far this year, the HHS Office for Civil Rights (OCR) has announced financial penalties with just two covered entities (CEs) and one business associate (BA) accused of HIPAA violations. AugCynergisTek today announced that Memorial Hermann Health System (Memorial Hermann), an integrated health system serving Southeast Texas and the Greater Houston community, has selected its Compliance Assist Partner Program (CAPP) to take a proactive approach to privacy and security amidst increased regulatory scrutiny in healthcare.

Cynergistek ocr tool kit