Insurer, OCR Reach $1.5M Settlement for HIPAA Breach
The Office for Civil Rights (OCR) has reached its first settlement with an organization on its large patient information breach list required in 2009 by the Health Information Technology for Economic and Clinical Health (HITECH) Act.
The HIPAA privacy and security enforcer settled Tuesday, March 13, with Blue Cross Blue Shield of Tennessee (BCBS) for $1.5 million for its 2009 HIPAA breach that affected more than 1 million individuals, according to a Department of Health & Human Services (HHS) press release. OCR reports to HHS.
The health insurer also agreed to a corrective action plan to "address gaps in its HIPAA compliance program."
BCBS reported to OCR in the fall of 2009 that 57 unencrypted computer hard drives were stolen from a leased facility in Tennessee containing PHI of more than 1 million individuals, including member names, social security numbers, diagnosis codes, dates of birth, and health plan identification numbers.
"BCBST failed to implement appropriate administrative safeguards to adequately protect information remaining at the leased facility by not performing the required security evaluation in response to operational changes," according to the HHS press release. "In addition, the investigation showed a failure to implement appropriate physical safeguards by not having adequate facility access controls; both of these safeguards are required by the HIPAA Security Rule."
- CMS Mulls Income-Adjusting MA Stars
- As Retail Clinics Surge, Quality Metrics MIA
- Providers Prep for New Payment Models as Population Health Grows
- Providers' Push to Consolidate Roils Payers
- Former NQF Co-Chair Linked to Conflicts of Interest in Journal Probe
- 3 Ways to Rev Employee Development Programs
- No Employee Satisfaction, No Patient-Centered Culture
- 6 Not-So-Good Reasons for Avoiding Population Health
- Medicare Cost, Quality Data Tools Weak, Says GAO
- Aligning Executive Compensation with Provider Mission