The U.S. Department of Health and Human Services Office for Civil Rights (OCR) has just received a joint settlement of $1,975,220 for the potential breaches of HIPAA arising following the theft of a laptop storing unencrypted ePHI data. The failure to adhere to the HIPAA Privacy and Security Rules and take necessary precautions to secure patient data on mobile devices played a large role in the breach occurring.
The OCR highlighted the importance of securing data held on mobile devices and stressed that it is the responsibility of healthcare organizations and their business associates to secure any data kept on patients. OCR Deputy Director of Health Information Privacy, Susan McAndrew, believes organizations can do more to enhance cybersecurity: “Our message to these organizations is simple: encryption is your best defense against these incidents.”
Following the news of the theft of a laptop from the Springfield Missouri Physical Therapy Center, Concentra Health Services (Concentra) was subjected to a review by the OCR. Documentation was found which clearly showed that mobile devices were believed to represent a critical security weakness, yet action was not taken to rectify this issue in time to prevent the data breach.
Data encryption was about to be put in place, although it was clear to the OCR that the attempts made to improve cybersecurity had been inadequate, ultimately leaving patient data exposed and at risk for an unacceptable length of time. It noted that there was a lack of security measures in place to protect ePHI. In addition to the financial penalty, Concentra has agreed to complete a review of its compliance policies and procedures and will correct any security issues.
In February 2013, QCA Health Plan, Inc. of Arkansas reported the theft of a laptop from a car which stored unencrypted data on 148 patients. Following the theft the company encrypted the data on all of its laptops, although the action was not enough for the company to prevent a fine being sanctioned. The OCR found multiple violations of the HIPAA Privacy and Security Rules with a settlement of $250,000 agreed and a host of updates to policies and procedures to be implemented.
Laptop and device theft can lead to HIPAA violations and it is vitally important that healthcare organizations take the appropriate steps to ensure data is secured and made inaccessible in the event of device theft.