HIPAA Violation Case Settled Between Ambulance Company & OCR for $65,000

by | Jan 2, 2020

The Department of Health and Human Services’ Office for Civil Rights (OCR) has revealed a $65,000 HIPAA violation settlement has been agreed with West Georgia Ambulance, Inc., to address multiple breaches of Health Insurance Portability and Accountability Act Rules.

OCR kicked off an investigation into the Carroll County, GA ambulance company after being made aware on February 11, 2013 about the loss of an unencrypted laptop computer holding the protected health information of 500 patients. The breach report stated that the laptop computer fell from the rear bumper of the ambulance and was not retrieved.

The investigation found longstanding noncompliance with several parts of the HIPAA Rules. OCR discovered West Georgia Ambulance had not completed a thorough, organization-wide risk analysis (45 C.F.R. § 164.308(a)(1)(ii)(A)), had not put in place a security awareness training program for its employees (45 C.F.R. § 164.308(a)(5)), and had failed to implement HIPAA Security Rule policies and procedures (45 C.F.R. § 164.316.).

OCR supplied technical assistance to West Georgia Ambulance to help the firm tackle its compliance failures, but despite that assistance, OCR said no meaningful steps were taken to resolve the areas of noncompliance. A financial penalty was issued as a result.

Additional Training Requirements Central to Corrective Action Plan

Along with paying the $65,000 financial penalty, West Georgia Ambulance is required to implement a corrective action plan to address all areas of noncompliance identified by OCR during the investigation. Central to the corrective plan are additional training requirements which consist of:

  • Submitting a new training program to OCR for review and approval.
  • If approved, all staff must receive HIPAA refresher training within 30 days.
  • All new hires during the term of the plan must receive training within 14 days.
  • Further refresher training must be provided during the term of the plan.
  • All staff members must attest to having received HIPAA training (written or electronically).
  • The HIPAA training materials must be reviewed annually and where appropriate, and updated as necessary.

OCR will also be looking into West Georgia Ambulance’s HIPAA compliance program for two years to make sure the terms of the corrective action plan are being complied with. OCR Director Roger Severino said: “The last thing patients being wheeled into the back of an ambulance should have to worry about is the privacy and security of their medical information. All providers, large and small, need to take their HIPAA obligations seriously.”

This represents the 10th OCR HIPAA financial penalty of 2019. Overall, $12,274,000 has been paid to OCR in 2019 to settle noncompliance issues.

Raise the level of HIPAA Awareness in your organization with Learner-Friendly, Comprehensive and Affordable HIPAA Training.


Please enable JavaScript in your browser to complete this form.

Patrick Kennedy

Patrick Kennedy is a highly accomplished journalist and editor with nearly two decades of experience in the field. With expertise in writing and editing content, Patrick has made significant contributions to various publications and organizations. Over the course of his career, Patrick has successfully managed teams of writers, overseeing the production of high-quality content and ensuring its adherence to professional standards. His exceptional leadership skills, combined with his deep understanding of journalistic principles, have allowed him to create cohesive and engaging narratives that resonate with readers. A notable area of specialization for Patrick lies in compliance, particularly in relation to HIPAA (Health Insurance Portability and Accountability Act). He has authored numerous articles delving into the complexities of compliance and its implications for various industries. Patrick's comprehensive understanding of HIPAA regulations has positioned him as a go-to expert, sought after for his insights and expertise in this field. Patrick's bachelors degree is from the University of Limerick and his master's degree in journalism is from Dublin City University. You can contact Patrick through his LinkedIn profile:

Raise the level of HIPAA Awareness in your organization with Learner-Friendly, Comprehensive and Affordable HIPAA Training.

Comprehensive HIPAA Training

Used in 1000+ Healthcare Organizations and 100+ Universities

    Full Course - Immediate Access

    Privacy Policy