Insurer, OCR Reach $1.5M Settlement for HIPAA Breach
The Office for Civil Rights (OCR) has reached its first settlement with an organization on its large patient information breach list required in 2009 by the Health Information Technology for Economic and Clinical Health (HITECH) Act.
The HIPAA privacy and security enforcer settled Tuesday, March 13, with Blue Cross Blue Shield of Tennessee (BCBS) for $1.5 million for its 2009 HIPAA breach that affected more than 1 million individuals, according to a Department of Health & Human Services (HHS) press release. OCR reports to HHS.
The health insurer also agreed to a corrective action plan to "address gaps in its HIPAA compliance program."
BCBS reported to OCR in the fall of 2009 that 57 unencrypted computer hard drives were stolen from a leased facility in Tennessee containing PHI of more than 1 million individuals, including member names, social security numbers, diagnosis codes, dates of birth, and health plan identification numbers.
"BCBST failed to implement appropriate administrative safeguards to adequately protect information remaining at the leased facility by not performing the required security evaluation in response to operational changes," according to the HHS press release. "In addition, the investigation showed a failure to implement appropriate physical safeguards by not having adequate facility access controls; both of these safeguards are required by the HIPAA Security Rule."
- Readmissions: No Quick Fix to Costly Hospital Challenge
- Ebola: Health Officials Try to Quell Front Line Fears
- How Telehealth Pays Off for Providers, Patients
- Reducing Readmissions Starts with Better Collaboration
- Defensive Medicine Still Prevalent Despite Tort Reform
- 'Overtreatment' Debate Circles Back to Lung Cancer Screening
- House Calls Key to Pioneer ACO Success
- Partners HealthCare M&A Deal Under Scrutiny
- How Top-Ranked MA Plans Earn Their Stars
- How Educated Nurses Save Money