Insurer, OCR Reach $1.5M Settlement for HIPAA Breach
In addition to the $1.5 million settlement, BCBS must:
- Review, revise, and maintain its privacy and security policies and procedures
- Conduct regular and robust trainings for all BCBST employees covering employee responsibilities under HIPAA
- Perform monitor reviews to ensure BCBST compliance with the corrective action plan
One of the requirements calls for BCBS to randomly audit facilities using portable devices.
"That's really something I have not seen before," said Ali Pabrai, MSEE, CISSP, chief executive of ecfirst, home of The HIPAA Academy. "They are making them randomly audit their facilities that house portable devices. The fact they are saying it should be done randomly and unannounced shows they are serious about this."
The interim final rule on breach notification went into effect only months before the BCBS breach. Pabrai says entities should take note that OCR is willing to go back years to investigate breaches.
"Go back and get as much detail as you can," Pabrai says of earlier breaches reported to OCR. "You've got to be ready for this."
Dom Nicastro is a contributing writer. He edits the Medical Records Briefings newsletter and manages the HIPAA Update Blog.
- As Medicare Advantage Cuts Loom, Disagreement Over Program's Stability
- Doctors Feel Pressure to Accept Risk-based Reimbursement
- Surgical Checklists Unused in 10% of Hospitals, CMS Data Shows
- Centralizing the Revenue Cycle Protects the Bottom Line
- A Fresh Look at End-of-Life Care
- CA Fines 8 Hospitals for Medical Errors
- 3 in 4 Patients Want E-mail Consultations
- Heart Attack Patient Costs Skyrocket Beyond 30 Days
- ACGME Chief Sees 'Huge' Risk of Error in Proposed Assistant Physician Licensure
- 3 Insider Tips on Cutting Costs without Strangling Growth