MGH to Pay $1M to Settle 'Potential' HIPAA Violation

The documents were lost when a Mass General employee, while commuting to work, left the documents on the subway. The records have not been recovered.

That investigation "indicated that Mass General failed to implement reasonable, appropriate safeguards to protect the privacy of protected health information when removed from Mass General's premises and impermissibly disclosed protected health information potentially violating provisions of the HIPAA Privacy Rule," the HHS statement said.

The correction plan also directs the hospital's Director of Internal Audit Services of Partners HealthCare System Inc. to serve as an internal monitor that will conduct assessments of Mass General's compliance with the corrective action plan and render semi-annual reports to HHS for a 3-year period."

See Also:
Are Your Business Associates Accountable for HIPAA Compliance?
NY Hospital Data Theft May Affect Records of 1.7 Million