Privacy & Information Security Law Blog

On March 16, 2016, and March 17, 2016, respectively, the Department of Health and Human Services (“HHS”) announced resolution agreements with North Memorial Health Care of Minnesota (“North Memorial”) and The Feinstein Institute for Medical Research (“Feinstein Institute”) over potential violations of the HIPAA Privacy Rule.

North Memorial

The HHS’s Office for Civil Rights (“OCR”) began an investigation of North Memorial, a non-profit health care system based in Minnesota, after North Memorial filed a breach report indicating that in September 2011, an unencrypted, password-protected laptop computer containing the protected health information (“PHI”) of 9,947 individuals was stolen from a locked vehicle of an employee of its contractor, Accretive Health (“Accretive”). In 2012, Accretive entered into a $2.5 million settlement with the Minnesota Attorney General for violations of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and its implementing regulations, and various Minnesota debt collection and consumer protection laws.

The resolution agreement requires North Memorial to pay $1.55 million to HHS and institute a corrective action plan to settle charges that it (1) disclosed the PHI of approximately 290,000 individuals to Accretive without entering into a business associate agreement (“BAA”) with Accretive, and (2) failed to conduct an organization-wide risk analysis to address the risks and vulnerabilities to the electronic health information (“ePHI”) it maintained, accessed and transmitted.

As part of its corrective action plan, North Memorial is required to:

• develop policies and procedures related to business associate relationships, including entering into BAAs with each of its business associates prior to disclosing PHI to them;
• conduct an organization-wide risk analysis and create a risk management plan with respect to all equipment and systems which contain, store, transmit or receive ePHI;
• provide training to its employees regarding business associates; and
• notify HHS of any employee-related violations of its policies and procedures related to business associate relationships.

In announcing the settlement with North Memorial, OCR Director Jocelyn Samuels noted that North Memorial had overlooked “[t]wo major cornerstones of the HIPAA Rules” by failing to enter into compliant BAAs and conducting a risk analysis.

Feinstein Institute

The OCR’s investigation of Feinstein Institute, a biomedical research institute based in New York, began after the institute filed a breach report indicating that in September 2012, an unencrypted, password-protected laptop computer containing the ePHI of approximately 13,000 patients and research participants was stolen from an employee’s car. The ePHI stored on the laptop included the names of research participants, dates of birth, addresses, Social Security numbers, diagnoses, laboratory results, medications and medical information relating to potential participation in a research study.

Among other findings, HHS’s investigation determined that Feinstein Institute:

• impermissibly disclosed the ePHI of approximately 13,000 individuals;
• lacked policies and procedures for authorizing access to ePHI by its employees;
• failed to implement safeguards to restrict access to unauthorized users;
• lacked policies and procedures to govern the receipt and removal of laptops containing ePHI into and out of its facilities; and
• failed to encrypt ePHI or implement an equivalent mechanism.

The resolution agreement requires Feinstein Institute to pay $3.9 million to HHS and institute a corrective action plan to settle charges that its security management processes were limited in scope, incomplete and insufficient. As part of its corrective action plan, Feinstein Institute is required to, among other things:

• conduct an organization-wide risk analysis and create a risk management plan with respect to all equipment and systems which contain, store, transmit or receive ePHI;
• conduct an annual risk assessment for the next three years and document security measures implemented to reduce the risks and vulnerabilities to ePHI identified in each assessment;
• annually review and revise its policies and procedures for the next three years to ensure they comply with the HIPAA Privacy Rules;
• refuse to provide access to ePHI to any employee who has not signed the organization’s HIPAA policies and procedures;
• notify HHS of any employee-related violations of its HIPAA policies and procedures; and
• provide training to its employees regarding its HIPAA policies and procedures.

OCR Director Jocelyn Samuels stated that the settlement with Feinstein Institute sends a strong message that “[r]esearch institutions subject to HIPAA must be held to the same compliance standards as all other HIPAA-covered entities.”