Cancer Practice Socked for $750K in Fines for Ignoring HIPAA
The HHS Office for Civil Rights has levied a $750,000 fine on Cancer Care Group, P.C., an Indianapolis-based oncology radiation practice serving hospitals and clinics, for substantial violations of the HIPAA security and privacy rules, OCR, which enforces HIPAA, has announced.
The HHS Office for Civil Rights has levied a $750,000 fine on Cancer Care Group, P.C., an Indianapolis-based oncology radiation practice serving hospitals and clinics, for substantial violations of the HIPAA security and privacy rules, OCR, which enforces HIPAA, has announced.
The practice also has agreed to complete an OCR-imposed corrective action plan. Cancer Care Group in August 2012 notified OCR that back-up media containing electronic protected health information on 55,000 current and former patients, as well as a laptop computer that did not contain ePHI, were stolen from an employee’s car after being left in the passenger seat. Compromised information included names, addresses, birth dates, Social Security numbers, insurance information and clinical information, according to an OCR statement. The type of back-up media stolen was not immediately available from OCR.
Also See: Feds Fine Hospital for Unsecure Internet Use
OCR’s subsequent investigation, the agency said, found that Cancer Care Group did not conduct a risk assessment following the theft of ePHI in the backup media, and it also had not conducted any assessments of potential risks and vulnerabilities, nor developed appropriate policies, since the HIPAA privacy and security rules went into effect.
“OCR found that these two issues, in particular, contributed to the breach, as an enterprise-wide risk analysis could have identified the removal of unencrypted back-up media as a significant risk to Cancer Care’s ePHI, and a comprehensive device and media control policy could have provided employees with direction in regard to their responsibilities when removing devices containing ePHI from the facility,” according to an OCR statement.
This is the 26th resolution agreement and corrective action plan that OCR has imposed on organizations that demonstrated blatant disregard for HIPAA privacy and security rules. The resolution agreement and corrective action plan for Cancer Care Group is available here. Cancer Care Group did not respond to a request for comment on the agreement.
The practice also has agreed to complete an OCR-imposed corrective action plan. Cancer Care Group in August 2012 notified OCR that back-up media containing electronic protected health information on 55,000 current and former patients, as well as a laptop computer that did not contain ePHI, were stolen from an employee’s car after being left in the passenger seat. Compromised information included names, addresses, birth dates, Social Security numbers, insurance information and clinical information, according to an OCR statement. The type of back-up media stolen was not immediately available from OCR.
Also See: Feds Fine Hospital for Unsecure Internet Use
OCR’s subsequent investigation, the agency said, found that Cancer Care Group did not conduct a risk assessment following the theft of ePHI in the backup media, and it also had not conducted any assessments of potential risks and vulnerabilities, nor developed appropriate policies, since the HIPAA privacy and security rules went into effect.
“OCR found that these two issues, in particular, contributed to the breach, as an enterprise-wide risk analysis could have identified the removal of unencrypted back-up media as a significant risk to Cancer Care’s ePHI, and a comprehensive device and media control policy could have provided employees with direction in regard to their responsibilities when removing devices containing ePHI from the facility,” according to an OCR statement.
This is the 26th resolution agreement and corrective action plan that OCR has imposed on organizations that demonstrated blatant disregard for HIPAA privacy and security rules. The resolution agreement and corrective action plan for Cancer Care Group is available here. Cancer Care Group did not respond to a request for comment on the agreement.
More for you
Loading data for hdm_tax_topic #better-outcomes...