Huge HIPAA Settlement Due to Unencrypted Data on Laptop

by | Sep 20, 2017

The U.S. Department of Health and Human Services Office for Civil Rights (OCR) has just received a joint settlement of $1,975,220 for the potential breaches of HIPAA arising following the theft of a laptop storing unencrypted ePHI data. The failure to adhere to the HIPAA Privacy and Security Rules and take necessary precautions to secure patient data on mobile devices played a large role in the breach occurring.

The OCR highlighted the importance of securing data held on mobile devices and stressed that it is the responsibility of healthcare organizations and their business associates to secure any data kept on patients. OCR Deputy Director of Health Information Privacy, Susan McAndrew, believes organizations can do more to enhance cybersecurity: “Our message to these organizations is simple: encryption is your best defense against these incidents.”

Following the news of the theft of a laptop from the Springfield Missouri Physical Therapy Center, Concentra Health Services (Concentra) was subjected to a review by the OCR. Documentation was found which clearly showed that mobile devices were believed to represent a critical security weakness, yet action was not taken to rectify this issue in time to prevent the data breach.

Data encryption was about to be put in place, although it was clear to the OCR that the attempts made to improve cybersecurity had been inadequate, ultimately leaving patient data exposed and at risk for an unacceptable length of time. It noted that there was a lack of security measures in place to protect ePHI. In addition to the financial penalty, Concentra has agreed to complete a review of its compliance policies and procedures and will correct any security issues.

In February 2013, QCA Health Plan, Inc. of Arkansas reported the theft of a laptop from a car which stored unencrypted data on 148 patients. Following the theft the company encrypted the data on all of its laptops, although the action was not enough for the company to prevent a fine being sanctioned. The OCR found multiple violations of the HIPAA Privacy and Security Rules with a settlement of $250,000 agreed and a host of updates to policies and procedures to be implemented.

Laptop and device theft can lead to HIPAA violations and it is vitally important that healthcare organizations take the appropriate steps to ensure data is secured and made inaccessible in the event of device theft.

Raise the level of HIPAA Awareness in your organization with Learner-Friendly, Comprehensive and Affordable HIPAA Training.


Please enable JavaScript in your browser to complete this form.

Patrick Kennedy

Patrick Kennedy is a highly accomplished journalist and editor with nearly two decades of experience in the field. With expertise in writing and editing content, Patrick has made significant contributions to various publications and organizations. Over the course of his career, Patrick has successfully managed teams of writers, overseeing the production of high-quality content and ensuring its adherence to professional standards. His exceptional leadership skills, combined with his deep understanding of journalistic principles, have allowed him to create cohesive and engaging narratives that resonate with readers. A notable area of specialization for Patrick lies in compliance, particularly in relation to HIPAA (Health Insurance Portability and Accountability Act). He has authored numerous articles delving into the complexities of compliance and its implications for various industries. Patrick's comprehensive understanding of HIPAA regulations has positioned him as a go-to expert, sought after for his insights and expertise in this field. Patrick's bachelors degree is from the University of Limerick and his master's degree in journalism is from Dublin City University. You can contact Patrick through his LinkedIn profile:

Raise the level of HIPAA Awareness in your organization with Learner-Friendly, Comprehensive and Affordable HIPAA Training.

Comprehensive HIPAA Training

Used in 1000+ Healthcare Organizations and 100+ Universities

    Full Course - Immediate Access

    Privacy Policy