Privacy & Information Security Law Blog

On July 21, 2016, the U.S. Department of Health and Human Services’ Office for Civil Rights (“OCR”) entered into resolution agreements with two large public health centers, Oregon Health & Science University (“OHSU”) and the University of Mississippi Medical Center (“UMMC”), over alleged HIPAA violations.

OHSU

Following the submission of multiple breach notification reports by OHSU in 2013, OCR investigated and found “evidence of widespread vulnerabilities within OHSU’s HIPAA compliance program.” These vulnerabilities included (1) storing electronic protected health information (“ePHI”) on a cloud-based server without entering into a business associate agreement (“BAA”) with the cloud provider; (2) conducting inadequate risk analyses; and (3) failing to implement a mechanism to encrypt and decrypt ePHI.

The resolution agreement requires OHSU to pay $2.7 million to OCR and enter into a Corrective Action Plan that obligates OHSU to:

• conduct an accurate and thorough risk assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of ePHI held by OHSU;
• develop a comprehensive risk management plan to address those risks and vulnerabilities identified in the risk analysis;
• implement a mobile device management solution to encrypt all OHSU-owned and personally-owned mobile devices that access ePHI;
• provide security awareness training to its workforce;
• report any events of noncompliance with its HIPAA policies and procedures; and
• submit annual compliance reports to OCR for a period of three years.

In announcing the settlement with OHSU, OCR Director Jocelyn Samuels noted that “OHSU had every opportunity to address security management processes that were insufficient.” She also stated that “[t]his settlement underscores the importance of leadership engagement and why it is so critical for the C-suite to take HIPAA compliance seriously.”

UMMC

The UMMC settlement also stemmed from a breach in 2013 that affected approximately 10,000 individuals. OCR’s investigation revealed that UMMC had failed to conduct any significant risk management activity despite being aware of certain risks and vulnerabilities to ePHI dating back to 2005. The investigation also noted that UMMC had failed to (1) implement policies and procedures to prevent, detect, contain and correct security violations; (2) implement physical safeguards for workstations that access ePHI; (3) assign a unique username or number to identify and track user identity in information systems that contain ePHI; and (4) notify each individual whose ePHI was affected by the breach.

The resolution agreement requires UMMC to pay $2.75 million to OCR and enter into a Corrective Action Plan that obligates UMMC to:

• designate an internal monitor to review UMMC’s compliance with the Corrective Action Plan and submit reports to OCR;
• draft an enterprise-wide risk analysis and risk management plan;
• update its Information Security Policy to comply with the HIPAA Security Rule;
• revise its breach notification policy;
• develop a plan to require a unique username and/or number to track users in systems that access ePHI;
• provide security awareness training to its workforce;
• report any events of noncompliance with its HIPAA policies and procedures; and
• submit annual compliance reports to OCR for a period of three years.

In announcing the settlement with UMMC, OCR Director Jocelyn Samuels stated that “[i]n addition to identifying risks and vulnerabilities to their ePHI, entities must also implement reasonable and appropriate safeguards to address them within an appropriate time frame.”

The two OCR settlements this July continue an active year by OCR in HIPAA enforcement. We wrote about prior OCR settlements in June, April and March of this year.