Physician Law Blog

The OCR announced a settlement of $218,400 along with adoption of a robust plan of correction with St. Elizabeth’s Medical Center (SEMC) of Brighton, MA for alleged HIPAA violations. Before the settlement, SEMC had two different events leading up to it entering the resolution agreement with HHS. The first allegation involved a complaint to the OCR that employees were using an internet-based document sharing application to store ePHI without analyzing the associated security risks, exposing at least 498 individuals’ ePHI.

Just ask Cornell Prescription Pharmacy about disposal of unshredded paper pharmacy records containing protected health information (PHI), and you will hear that this pharmacy paid $125,000 plus it has entered a Resolution Agreement with the OCR. Not only is this pharmacy paying a significant penalty, it will be under a corrective action plan to correct deficiencies in their HIPAA compliance program and must submit the members of their workforce to receive training on that program within 30 days of implementing the policies and procedures.

Susan McAndrew, Office of Civil Rights deputy director for health information privacy spoke at the HIMSS Conference on 2/24/14. As the OCR already made known, it plans to resume its HIPAA compliance audit program this year following the Pilot HIPAA Audit program in 2012. Now, more information is available on the progress towards the start of those audits. Ms. McAndrew addressed the topic, noting that “hopefully in the coming months you’ll see actual activity that will start the audit process.”