The Department of Health and Human Services’ Office for Civil Rights (OCR) has revealed a $65,000 HIPAA violation settlement has been agreed with West Georgia Ambulance, Inc., to address multiple breaches of Health Insurance Portability and Accountability Act Rules.
OCR kicked off an investigation into the Carroll County, GA ambulance company after being made aware on February 11, 2013 about the loss of an unencrypted laptop computer holding the protected health information of 500 patients. The breach report stated that the laptop computer fell from the rear bumper of the ambulance and was not retrieved.
The investigation found longstanding noncompliance with several parts of the HIPAA Rules. OCR discovered West Georgia Ambulance had not completed a thorough, organization-wide risk analysis (45 C.F.R. § 164.308(a)(1)(ii)(A)), had not put in place a security awareness training program for its employees (45 C.F.R. § 164.308(a)(5)), and had failed to implement HIPAA Security Rule policies and procedures (45 C.F.R. § 164.316.).
OCR supplied technical assistance to West Georgia Ambulance to help the firm tackle its compliance failures, but despite that assistance, OCR said no meaningful steps were taken to resolve the areas of noncompliance. A financial penalty was issued as a result.
Additional Training Requirements Central to Corrective Action Plan
Along with paying the $65,000 financial penalty, West Georgia Ambulance is required to implement a corrective action plan to address all areas of noncompliance identified by OCR during the investigation. Central to the corrective plan are additional training requirements which consist of:
- Submitting a new training program to OCR for review and approval.
- If approved, all staff must receive HIPAA refresher training within 30 days.
- All new hires during the term of the plan must receive training within 14 days.
- Further refresher training must be provided during the term of the plan.
- All staff members must attest to having received HIPAA training (written or electronically).
- The HIPAA training materials must be reviewed annually and where appropriate, and updated as necessary.
OCR will also be looking into West Georgia Ambulance’s HIPAA compliance program for two years to make sure the terms of the corrective action plan are being complied with. OCR Director Roger Severino said: “The last thing patients being wheeled into the back of an ambulance should have to worry about is the privacy and security of their medical information. All providers, large and small, need to take their HIPAA obligations seriously.”
This represents the 10th OCR HIPAA financial penalty of 2019. Overall, $12,274,000 has been paid to OCR in 2019 to settle noncompliance issues.
