The Office for Civil Rights (OCR) of the HHS has issued the largest ever financial penalty, $4.8m, for a violation of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy and Security Rules.
The data breach happpened when a computer server firewall was turned off by a physician at Columbia University leaving electronic PHI exposed and accessible via search engines. The data breach was discovered when an individual found ePHI of a deceased partner when browsing on the internet.
The data was stored on a server operating within a shared network used by both New York and Presbyterian Hospital (NYP) and Columbia University (CU), under the security of a shared network firewall. When a privately owned computer server was deactivated by a physician – who had developed applications for the healthcare organization – the data became accessible via the search engines.
An investigation was carried out on NYP and CU by the OCR after a data breach notice was released jointly by the two healthcare institutions. The incident exposed the ePHI of 6,800 people. The data exposed included medications prescribed and medical test results.
The $4.8M settlement is the biggest so far and has been issued based on the “factual background” that all parties accept, although neither NYP nor CU has accepted liability for the potential loss of data. The penalty was issued because the bodies in question failed to complete a risk analysis and did not employ the appropriate security measures to minimize the risk to electronic PHI.
NYP has agreed to pay the bulk of the cost and has now transferred $3.3M to the OCR, while Columbia University is covering $1.5 million. Both institutions have also agreed to carry out a complete review of their policies and procedures, including developing risk management strategies and conducting a full risk analysis to find potential security weaknesses.
They have also agreed to give the staff additional training on data security and privacy issues. Had these steps been put in place prior to the data breach as required by HIPAA regulations, the data exposure and financial penalty could have been prevented.