Insurer, OCR Reach $1.5M Settlement for HIPAA Breach
The Office for Civil Rights (OCR) has reached its first settlement with an organization on its large patient information breach list required in 2009 by the Health Information Technology for Economic and Clinical Health (HITECH) Act.
The HIPAA privacy and security enforcer settled Tuesday, March 13, with Blue Cross Blue Shield of Tennessee (BCBS) for $1.5 million for its 2009 HIPAA breach that affected more than 1 million individuals, according to a Department of Health & Human Services (HHS) press release. OCR reports to HHS.
The health insurer also agreed to a corrective action plan to "address gaps in its HIPAA compliance program."
BCBS reported to OCR in the fall of 2009 that 57 unencrypted computer hard drives were stolen from a leased facility in Tennessee containing PHI of more than 1 million individuals, including member names, social security numbers, diagnosis codes, dates of birth, and health plan identification numbers.
"BCBST failed to implement appropriate administrative safeguards to adequately protect information remaining at the leased facility by not performing the required security evaluation in response to operational changes," according to the HHS press release. "In addition, the investigation showed a failure to implement appropriate physical safeguards by not having adequate facility access controls; both of these safeguards are required by the HIPAA Security Rule."
- Federal Appeals Court Mulls Observation Status
- How the Military's EHR Reboot Will Impact Interoperability
- HCA to Acquire CareNow Urgent Care Centers
- How One Health System Saved $3.5M in Benefits Costs
- BCBS Tries New Drug Contracting Model
- Abington Health, Jefferson Health Plan '100% Equal' Merger
- Dental Board Case Before SCOTUS Has Far-Reaching Implications
- The Case for Recycling Surgical Supplies
- 'Leadership Gap' Threatens MU Momentum, Says AMA
- Ballot Initiative Pits Providers Against Payers in SD