The largest ever financial penalty for violation of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy and Security Rules has been issued this by the Office for Civil Rights (OCR) of the HHS issue.
The data breach was happened when a computer server firewall was turned off by a physician at Columbia University leaving electronic PHI exposed and accessible via search engines. The data breach was discovered when a person discovered ePHI of a deceased partner when searching on the internet.
The data was stored on a server operating within a shared network used by both New York and Presbyterian Hospital (NYP) and Columbia University (CU), under the security of a shared network firewall. When a privately owned computer server was deactivated by a physician – who had developed applications for the healthcare group – the data became accessible via the search engines.
An investigation was carried out on NYP and CU by the OCR after a data breach notice was released jointly by the two healthcare institutions. The incident showed the ePHI of 6,800 people. The data exposed included medications prescribed and medical test results.
The $4.8M settlement is the biggest so far to date and has been issued based on the “factual background” that all parties accept, although neither NYP nor CU has accepted liability for the potential loss of data. The penalty was applied because the entities in question did not conduct a risk analysis and did not employ the appropriate security measaures to minimize the risk to electronic PHI.
NYP has agreed to cover the majority of the cost and has now paid the OCR $3.3M, while Columbia University is covering $1.5 million. Both institutions have also agreed to carry out a complete review of their policies and procedures, including developing risk management procedures and conducting a full risk analysis to identify potential security weaknesses.
They will also supply their staff with training on data security and privacy issues. Had these steps been put in place prior to the data violation as required by HIPAA regulations, the data exposure and financial penalty could have been prevented.
