HIPAA Compliance News

HIPAA Business Associate Fined $75,000 for Maintaining ePHI on an Unsecured Server

Posted June 29, 2023 by Steve Alder

The Department of Health and Human Services (HHS) Office for Civil Rights (OCR) has agreed to settle potential HIPAA violations with the HIPAA business associate, iHealth Solutions, LLC, for $75,000.

iHealth Solutions, doing business as Advantum Health, failed to secure one of its servers, which was accessed by an unauthorized individual who exfiltrated files that contained the electronic protected health information (ePHI) of 267 individuals. The HIPAA enforcement action shows that even relatively small data breaches can be investigated by OCR and result in a financial penalty. The last three penalties imposed by OCR to resolve HIPAA violations were all related to data breaches that affected fewer than 500 individuals.

Like many HIPAA-regulated entities that have been investigated by OCR after reporting data breaches, iHealth Solutions was discovered to have failed to comply with one of the most fundamental provisions of the HIPAA Rules – the risk analysis. All HIPAA-regulated entities must conduct an accurate, thorough, organization-wide risk analysis to identify all risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI – 45 C.F.R. §164.502(a).

OCR was notified about the data breach on August 22, 2017, and was informed that the ePHI of 267 individuals had been exfiltrated from the unsecured server. The fine was imposed for the impermissible disclosure of ePHI and the risk analysis failure.

In addition to the financial penalty, iHealth Solutions has agreed to implement a corrective action plan which includes the requirement to conduct an accurate and thorough assessment of the potential security risks and vulnerabilities to the confidentiality, integrity, and availability of iHealth’s ePHI, develop a risk management plan to address and mitigate all security risks identified in the risk analysis, develop a process to evaluate any environmental or operational changes that affect the security of iHealth ePHI, and develop, maintain, and revise, as necessary, written policies and procedures to ensure compliance with the HIPAA Privacy and Security Rules. OCR will monitor iHealth Solutions for two years to ensure compliance with the HIPAA Rules.

“HIPAA business associates must protect the privacy and security of the health information they are entrusted with by HIPAA-covered entities,” said OCR Director Melanie Fontes Rainer. “Effective cybersecurity includes ensuring that electronic protected health information is secure, and not accessible to just anyone with an internet connection.”

This is the 7^th OCR enforcement action of 2023 to result in a financial penalty, and the third enforcement action to be announced by OCR this month. So far this year, OCR has fined HIPAA-regulated entities a total of $1,976,500 to resolve violations of the HIPAA Rules. See HIPAA Violation Fines.

The post HIPAA Business Associate Fined $75,000 for Maintaining ePHI on an Unsecured Server appeared first on HIPAA Journal.

Senators Demand Answers on Amazon Clinic’s Uses of Customer Data

Posted June 26, 2023 by Steve Alder

Two Democratic senators have demanded answers from Amazon about how it uses the data of customers of Amazon Clinic after an investigation by the Washington Post revealed individuals wishing to enroll in Amazon Clinic are required to sign away some of their privacy rights in order to use the service.

Amazon Clinic was launched in November 2022 and provides virtualized healthcare services. Amazon advertises the service as “a virtual healthcare storefront through which telehealth services are offered,” with those telehealth services provided by third-party healthcare providers. The Washington Post was contacted by a reader who requested an investigation of Amazon Clinic over the terms and conditions of its sign-up form. When enrolling for Amazon Clinic, users are required to provide consent to allow the use and disclosure of their protected health information. The form states that after providing consent Amazon will be authorized to have access to a complete patient file, may re-disclose information contained in that file and that the information disclosed will no longer be subject to the HIPAA Rules. While the terms are voluntary, individuals have no option of using Amazon Clinic if they do not agree to the terms and conditions.

Senators Peter Welch (D-VT) and Elizabeth Warren (D-MA) recently wrote to Amazon’s President and Chief Executive Officer, Andy Jassy, and expressed their concern that Amazon may be harvesting the health data of Amazon Clinic customers. The senators have demanded answers about how Amazon uses customers’ health data and whether Amazon is using the data collected from Amazon Clinic customers to sell them other Amazon products or services.

The form provided by Amazon Clinic is essentially a HIPAA Authorization, which is required by HIPAA-regulated entities before any disclosures of protected health information are possible that are not expressly permitted by the HIPAA Privacy Rule. The HIPAA Privacy Rule also prohibits conditioning care on signing an authorization to disclose patient information. The senators point out that the HIPAA authorization that Amazon Clinic customers are required to sign does not state how patient data will be used or shared. Essentially the signing of the authorization form gives Amazon full access to customers’ health data and allows the information to be used and redisclosed as Amazon sees fit. Amazon Clinic’s terms and conditions state that customer data is not used for any purposes that its customers have not consented to, yet no information is provided about why customer health data is collected and how that information will be used.

The senators explained that the Federal Trade Commission (FTC) recently fined telehealth provider GoodRx for failing to inform consumers that their health data was disclosed to third parties for advertising purposes, and in addition to paying a financial penalty, GoodRx has been prohibited from using manipulative methods – termed dark patterns – to obtain users’ consent to use and share their health information. “Amazon Clinic customers deserve to fully understand why Amazon is collecting their health care data and what the company is doing with it. Congress is also evaluating legislative efforts to protect health data in the context of emerging technologies,” wrote the senators.

The senators have asked Amazon to provide further information on its privacy practices by June 30, 2023, including a sample of the contract between Amazon and the third-party telehealth providers that have signed up with Amazon Clinic, a list of data elements collected from consumers that sign up for the service, a list of the data elements that are shared with other entities within Amazon Group, and a list of all uses of health data. Amazon was also asked whether any collected health data is used by its analytics and algorithms or for marketing, is sold to third parties, or is provided to federal, state, or local law enforcement authorities.

The post Senators Demand Answers on Amazon Clinic’s Uses of Customer Data appeared first on HIPAA Journal.

May 2023 Healthcare Data Breach Report

Posted June 20, 2023 by Steve Alder

May 2023 was a particularly bad month for healthcare data breaches. 75 data breaches of 500 or more healthcare records were reported to the HHS’ Office for Civil Rights (OCR) in May. May – along with October 2022 – was the second-worst-ever month for healthcare data breaches, only beaten by the 95 breaches that were reported in September 2020. Month-over-month there was a 44% increase in reported data breaches and May’s total was well over the 12-month average of 58 data breaches a month.

May was also one of the worst-ever months in terms of the number of breached records, which increased by 330% month-over-month to an astonishing 19,044,544 breached records. Over the past 12 months, the average number of records breached each month is 6,104,761 and the median is 5,889,562 records. 46.52 of the breached records in May came from one incident, which exposed the records of almost 8.9 million individuals, and 90.45% of the breached records came from just three security incidents. More healthcare records have been breached in the first 5 months of 2023 (36,437,539 records) than in all of 2020 (29,298,012 records).

Largest Healthcare Data Breaches in May 2023

23 data breaches of 10,000 or more records were reported to OCR in May, including the two largest healthcare data breaches of 2023. The worst data breach was a LockBit ransomware attack on the HIPAA business associate Managed Care of North America (MCNA) which affected almost 8.9 million individuals. The LockBit gang stole data, threatened to publish the information on its website if the $10 million ransom was not paid, and when it wasn’t, uploaded leaked the stolen data. Almost 6 million records were stolen in a ransomware attack on PharMerica Corporation and its subsidiary BrightSpring Health Services. The Money Message ransomware group exfiltrated 4.7 terabytes of data in the attack and proceeded to upload the stolen data to its data leak site when the ransom was not paid.

A third million+ record data breach resulted in the exposure and potential theft of the protected health information of 2,550,922 Harvard Pilgrim Health Care plan members following a cyberattack on its parent Company, Point32Health, the second largest health insurer in Massachusetts. This was also a ransomware attack with data theft confirmed. Other large data breaches include a hacking incident at the Virginia-based business associate, Credit Control Corporation (345,523 records), and ransomware attacks affecting Onix Group (319,500 records), the Iowa Department of Health and Human Services (233,834 records), and Albany ENT & Allergy Services, PC (224,486 records).

Healthcare Data Breaches of 10,000 or More Records

Name of Covered Entity	State	Covered Entity Type	Individuals Affected	Cause of Breach
Managed Care of North America (MCNA)	GA	Business Associate	8,861,076	Ransomware attack (LockBit) – Data theft confirmed
PharMerica Corporation	KY	Healthcare Provider	5,815,591	Hacking Incident – data theft confirmed
Harvard Pilgrim Health Care	MA	Health Plan	2,550,922	Ransomware attack – Data theft confirmed
R&B Corporation of Virginia d/b/a Credit Control Corporation	VA	Business Associate	345,523	Hacking Incident – data theft confirmed
Onix Group	PA	Business Associate	319,500	Ransomware attack – Data theft confirmed
Iowa Department of Health and Human Services – Iowa Medicaid (Iowa HHS-IM)	IA	Health Plan	233,834	Ransomware attack (LockBit) on its business associate (MCNA Dental) – Data theft confirmed
Albany ENT & Allergy Services, PC.	NY	Healthcare Provider	224,486	Ransomware attack (BianLian/RansomHouse) – Data theft confirmed
Uintah Basin Healthcare	UT	Healthcare Provider	103,974	Hacking Incident
UI Community Home Care, a subsidiary of University of Iowa Health System	IA	Healthcare Provider	67,897	Cyberattack on subcontractor (ILS) of its business associate (Telligen) – data theft confirmed
University Urology	NY	Healthcare Provider	56,816	Hacking Incident
Illinois Department of Healthcare and Family Services, Illinois Department of Human Services	IL	Health Plan	50,839	Hackers compromised the state Application for Benefits Eligibility (ABE) system
New Mexico Department of Health	NM	Healthcare Provider	49,000	Impermissible disclosure of deceased individuals’ PHI per access request by a journalist
Pioneer Valley Ophthalmic Consultants, PC	MA	Healthcare Provider	36,275	Malware infection at business associates (Alta Medical Management and ECL Group, LLC)
Brightline, Inc.	CA	Business Associate	28,975	Hacking of Fortra GoAnywhere MFT solution
Clarke County Hospital	IA	Healthcare Provider	28,003	Hacking Incident
United Healthcare Services, Inc. Single Affiliated Covered Entity	CT	Health Plan	26,561	Hacking Incident
ASAS Health, LLC	TX	Healthcare Provider	25,527	Hacking Incident
iSpace, Inc.	CA	Business Associate	24,382	Hacking Incident – data theft confirmed
PillPack LLC	NH	Healthcare Provider	19,032	Credential stuffing attack allowed customer account access
Solutran	MN	Business Associate	17,728	Hacking incident
MedInform, Inc.	OH	Business Associate	14,453	Hacking Incident – data theft confirmed
Catholic Health System	NY	Healthcare Provider	12,759	hacking incident at business associate (Minimum Data Set Consultants) – data theft confirmed
Northwest Health – La Porte	IN	Healthcare Provider	10,256	Paper records were removed from locked shredding bins at an old facility

Causes of May 2023 Healthcare Data Breaches

The vast majority of the month’s data breaches were hacking/IT incidents, many of which were ransomware attacks and data theft/extortion attempts. 81.33% of the month’s data breaches (61 incidents) were hacking/IT incidents and those incidents accounted for 99.54% of all breached records. The protected health information of 18,956,101 individuals was exposed or stolen in those incidents. The average data breach size was 310,756 records and the median breach size was 3,833 records. There were 11 data breaches reported as unauthorized access/disclosure incidents, which affected 82,236 individuals. The average breach size was 7,476 records and the median breach size was 1,809 records. Two theft incidents were reported involving a total of 5,632 records and there was one incident involving the improper disposal of 575 paper records.

Unsurprisingly given the large number of hacking incidents, 57 data breaches involved electronic protected health information stored on network servers. There were also 9 data breaches involving electronic protected health information in email accounts.

Where Did the Breaches Occur?

When data breaches occur at business associates of HIPAA-regulated entities, they are either reported by the business associate, the HIPAA-regulated entity, or a combination of the two, depending on the terms of their business associate agreements. In May, 36 breaches were reported by healthcare providers, 25 by business associates, and 14 by health plans; however, those figures do not accurately reflect where the data breaches occurred. The pie charts below show where the data breaches occurred rather than the entity that reported the data breach, along with the number of records that were exposed or impermissibly disclosed in those data breaches.

Geographical Distribution of Healthcare Data Breaches

Data breaches of 500 or more records were reported by HIPAA-regulated entities in 30 states. While Massachusetts tops the list with 15 data breaches reported, 13 of those breaches were the same incident. Alvaria, Inc. submitted a separate breach report to OCR for each of its affected healthcare clients. As such, California and New York were the worst affected states with 7 breaches each.

State	Number of Reported Data Breaches
Massachusetts	15
California & New York	7
Connecticut, Iowa & Ohio	4
Illinois, New Jersey & Philadelphia	3
Alaska, Indiana, Missouri & Texas	2
Arizona, Arkansas, Georgia, Kansas, Kentucky, Michigan, Minnesota, New Hampshire, New Mexico, Oklahoma, South Dakota, Tennessee, Utah, Virginia, Washington, West Virginia & Wisconsin	1

Click here to view more detailed healthcare data breach statistics.

HIPAA Enforcement Activity in May 2023

After two months with no HIPAA enforcement actions, there was a flurry of enforcement activity in May over HIPAA compliance failures. Two financial penalties were imposed by OCR to resolve HIPAA violations, two enforcement actions were announced by state attorneys general, and the Federal Trade Commission (FTC) announced an enforcement action against a non-HIPAA-regulated entity for the impermissible disclosure of consumer health information.

In May, OCR announced its 44th financial penalty under its HIPAA Right of Access enforcement initiative, which was launched in the fall of 2019. David Mente, MA, LPC, a Pittsburgh-based counselor, was fined $15,000 for failing to provide a father with the medical records of his minor children, despite the father making two requests for the records and OCR providing technical assistance after the first complaint was filed.

Between January 2020 and June 2023, OCR imposed 61 financial penalties on HIPAA-regulated entities to resolve potential violations of the HIPAA Rules, 69% of which were for HIPAA Right of Access violations. We are now starting to see more financial penalties imposed for other violations. May’s other HIPAA settlement involved a financial penalty of $350,000 for MedEvolve Inc., a Little Rock, AR-based business associate that provides practice management, revenue cycle management, and practice analytics software to HIPAA-regulated entities. MedEvolve had misconfigured an FTP server which exposed the electronic protected health information of 230,572 individuals. OCR investigated and determined that in addition to the impermissible disclosure, MedEvolve had failed to conduct a comprehensive, accurate, and organization-wide risk analysis and had not entered into a business associate agreement with a subcontractor.

The New York Attorney General agreed to a settlement to resolve violations of HIPAA and state laws that were discovered during an investigation of Professional Business Systems Inc, which does business as Practicefirst Medical Management Solutions and PBS Medcode Corp. The medical management company was investigated after reporting a ransomware attack and data breach that impacted 1.2 million individuals. The hackers gained access to its network by exploiting a vulnerability that had not been patched, despite the patch being available for 22 months. Practicefirst was determined to have violated HIPAA and state laws through patch management failures, security testing failures, and not implementing encryption. The case was settled for $550,000.

A multi-state investigation of the vision care provider, EyeMed Vision Care, over a 2.1 million-record data breach was settled with the state attorneys general in Oregon, New Jersey, Florida, and Pennsylvania. A hacker gained access to an employee email account that contained approximately 6 years of personal and medical information including names, contact information, dates of birth, and Social Security numbers. The investigation revealed there had been several data security failures, including a lack of administrative, technical, and physical safeguards, in violation of HIPAA and state laws. The case was settled for $2.5 million.

The FTC has started actively policing the FTC Act and Health Breach Notification Rule and announced its third enforcement action of the year in May. Easy Healthcare, the developer and distributor of the Premom Ovulation Tracker (Premom) app, was alleged to have shared the health data of app users with third parties without user consent, in violation of the FTC Act, and failed to issue notifications, in violation of the Health Breach Notification Rule. Easy Healthcare agreed to settle the case and paid a $200,000 financial penalty.

The post May 2023 Healthcare Data Breach Report appeared first on HIPAA Journal.

24 State Attorneys General Confirm Support for Stronger HIPAA Protections for Reproductive Health Data

Posted June 19, 2023 by Steve Alder

A coalition of 24 state attorneys general has written to the Department of Health and Human Services (HHS) to confirm their support for the proposed update to the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule to strengthen reproductive health information privacy.

Background

The decision of the Supreme Court in Dobbs v. Jackson Women’s Health Organization in June 2022 overturned Roe v. Wade and removed the federal right to abortion. Many states introduced their own laws banning or severely restricting abortions in their respective states, and those laws permit criminal or civil penalties for anyone that seeks, provides, or assists with the provision of an abortion. Currently, 15 states have introduced almost total bans on abortions and several others have restricted abortions or are in the process of introducing bans or restrictions. Idaho has also recently enacted an abortion trafficking law, which aims to restrict the ability of state residents to travel out of state to receive abortion care.

Following the Supreme Court decision, the HHS’ Office for Civil Rights (OCR) issued guidance to HIPAA-regulated entities on the HIPAA Privacy Rule and how it permits but does not require disclosures of reproductive health information if the disclosure is required by law or is for law enforcement purposes. OCR confirmed that if a patient in a state that has banned abortions informs their healthcare provider that they are seeking an abortion in a state where abortion is legal, the HIPAA Privacy Rule would not permit the healthcare provider to disclose that information to law enforcement in order to prevent the abortion.

OCR subsequently issued a notice of proposed rulemaking (NPRM) about a planned update to the HIPAA Privacy Rule to strengthen reproductive health data privacy further, which would make it illegal to share a patient’s PHI if that information is being sought for certain criminal, civil, and administrative investigations or proceedings against a patient in connection with a legal abortion or other reproductive care.

In response to the NPRM, a coalition of 24 state attorneys general recently wrote to the HHS’ Secretary, Xavier Becerra, and OCR Director, Melanie Fontes Rainer, to confirm their support for the proposed HIPAA Privacy Rule changes. The coalition is led by New York Attorney General, Leticia James, and the letter was signed by the state Attorneys General in Arizona, California, Colorado, Connecticut, Delaware, Hawaii, Illinois, Maine, Maryland, Massachusetts, Michigan, Minnesota, Nevada, New Jersey, New York, New Mexico, North Carolina, Oregon, Pennsylvania, Rhode Island, Vermont, Washington, Wisconsin, and Washington D.C. The state AGs requested the HHS “move expeditiously to issue [the proposed rule] and apply the standard compliance date of 180 days after the effective date of the final rule.”

“No one should have to worry about whether their health care information will be kept private when they go to the doctor to get the care they need,” said Attorney General James. “While anti-choice state legislatures across the nation are stripping away our reproductive freedom and seeking access to health care data, it is imperative that we take every measure to safeguard Americans’ privacy. I will always fight to defend abortion and ensure no one’s private right to choose can be used against them.”

Recommendations to Further Strengthen Reproductive Health Information Privacy

In addition to confirming their support, comment has been provided on areas where the protections stated in the proposed rule can be strengthened further. The proposed Privacy Rule update adopts a broad definition of “reproductive health care” as a subcategory of health care; however, the state AGs recommend also creating a separate definition of “reproductive health,” to make it clear that the update not only applies to providers of gynecological and/or fertility-related care but also to other HIPAA covered entities. This would help to avoid any possible ambiguities about the types of health care covered by the proposed rule and they recommend that examples of reproductive health care are incorporated into the regulatory text of the final rule.

The state AGs also call for the HHS to define “birth” and “death” separately, in order to clarify that termination of pregnancy is not a public health reporting event and is therefore not subject to the HIPAA Privacy Rule reporting requirements. They also call for tightening up of the language in the proposed rule, which prohibits “use or disclosure “primarily for the purpose of investigating or imposing liability on any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care.” There is concern that a different primary purpose may be manufactured as a pretext for obtaining PHI for a prohibited purpose. This potential loophole could be closed by dropping the word ‘primary’.

Among the other recommendations are for the HHS to ensure that requesters and providers receive adequate guidance on the attestation requirement of the proposed rule, which requires attestation that the request is not being made to obtain reproductive health information to take legal action against an individual, and for the HHS to create a nationally available, online platform to provide patients with accurate and clear information on reproductive care and privacy rights, and to conduct a public awareness campaign to promote the website.

The post 24 State Attorneys General Confirm Support for Stronger HIPAA Protections for Reproductive Health Data appeared first on HIPAA Journal.

Washington Hospital Pays $240,000 HIPAA Penalty After Security Guards Access Medical Records

Posted June 15, 2023 by Steve Alder

The HHS’ Office for Civil Rights (OCR) investigates all reported breaches of the protected health information of 500 or more individuals and some smaller breaches to determine if the breach was caused by the failure to comply with the HIPAA Rules. OCR’s latest HIPAA enforcement action confirms that it is not the scale of a data breach that determines if a financial penalty must be paid but the severity of the underlying HIPAA violations.

A relatively small data breach was reported to OCR on February 28, 2018, by Yakima Valley Memorial Hospital (formerly Virginia Mason Memorial), a 222-bed non-profit community hospital in Washington state. The hospital discovered security guards had been accessing the medical records of patients when there was no legitimate work reason for the medical record access, and 419 medical records had been impermissibly viewed.

OCR launched an investigation into the snooping incident in May 2018 and discovered widespread snooping on medical records by security guards in the hospital’s emergency department. 23 security guards had used their login credentials to access medical records in the hospital’s electronic medical record system when there was no legitimate reason for the access. The security guards were able to view protected health information such as names, addresses, dates of birth, medical record numbers, certain notes related to treatment, and insurance information. OCR determined that the hospital had failed to implement reasonable and appropriate policies and procedures to comply with the standards, implementation specifications, or other requirements of the Security Rule – 45 C.F.R. § 164.316.

Yakima Valley Memorial Hospital chose to settle the case with OCR and agreed to pay a financial penalty of $240,000 with no admission of liability. A corrective action plan has been adopted to ensure full compliance with the HIPAA Rules, which includes an accurate and comprehensive risk analysis, the development and implementation of a risk management plan to address the risks identified by the risk analysis, updates to its HIPAA policies and procedures, the enhancement of its current HIPAA security training program, and a review of its relationships with vendors and third-party service providers to identify business associates, and to obtain business associate agreements if they are not already in place.

“Data breaches caused by current and former workforce members impermissibly accessing patient records are a recurring issue across the healthcare industry. Healthcare organizations must ensure that workforce members can only access the patient information needed to do their jobs,” said OCR Director Melanie Fontes Rainer. “HIPAA-covered entities must have robust policies and procedures in place to ensure patient health information is protected from identity theft and fraud.”

This is the 6^th OCR HIPAA enforcement action of 2023 that has resulted in a financial penalty, and the second to be announced by OCR this month. So far this year, penalties totaling $1,901,500 have been imposed by OCR to resolve violations of the HIPAA Rules.

The post Washington Hospital Pays $240,000 HIPAA Penalty After Security Guards Access Medical Records appeared first on HIPAA Journal.

Mistrial Declared in Criminal HIPAA Prosecution of Couple Who Disclosed PHI to Undercover FBI Agent

Posted June 6, 2023 by Steve Alder

The prosecution of two doctors accused of criminal HIPAA violations and conspiring with the Russian government has ended in a mistrial as the jury could not reach a unanimous guilty verdict. Dr. Anna Gabrielian. 37, a former anesthesiologist at Johns Hopkins, and her spouse, Jamie Lee Henry, 40, a doctor and U.S. Army Major previously stationed at Fort Bragg, were indicted on September 28, 2022, and charged with conspiracy to assist Russia with its invasion of Ukraine and criminal HIPAA violations for wrongfully disclosing the personally identifiable health information of individuals to someone they believed to be a Russian agent.

In an eight-count indictment, the couple was alleged to have conspired to cause harm to the United States by providing the sensitive information of U.S. citizens associated with the U.S. government and military to Russia. The disclosures started on August 17, 2022, when information was passed to an individual who they believed to be a Russian agent. The disclosures served as confirmation of Henry’s secret-level security clearance and the couple’s willingness to work with a Russian operative and provide medical information that could potentially be exploited by the Russian government.

Gabrielian had sent an email from her work email account to the Russian embassy offering medical collaboration and humanitarian aid to Russia in response to the war with Ukraine. The message was obtained by the FBI, which sent an undercover agent posing as a Russian operative to meet with Gabrielian. In the meeting, Gabrielian told the agent that her husband was a more important source for Russia as he had access to more valuable information, then arranged to meet with the undercover agent with her husband.

The undercover agent recorded over 5 hours of conversations over the series of meetings in which the couple claimed they wanted to help Russia. Henry admitted that he had attempted to sign up as a volunteer in the Russian Army but was turned down due to his lack of combat experience. Henry agreed to provide the medical records of Fort Bragg patients to the agent. In a subsequent meeting, Gabrielian provided the agent with the health information of two individuals, including the spouse of an employee of the Office of Naval Intelligence, whom Gabrielian pointed out had a medical condition Russia could exploit. Henry provided information on five individuals who were military veterans or related to military veterans. The couple faced a maximum sentence of 10 years in jail for the criminal HIPAA violation – accessing and disclosing medical records without authorization – and a maximum of 5 years in jail for the conspiracy charge.

At the trial, Gabrielian testified that she disclosed the information because she feared for her life and the lives of her family in the United States and Russia if she did not cooperate. She also testified that she saw the camera worn by the agent and asked if she was being recorded, which led to her believing she was in danger. She claimed that she provided two records to the agent as a test of loyalty, but thought the two records would be useless to the Russian government, as were the records disclosed by Henry.

The legal team for the doctors argued that while the agent did not overtly threaten them, and only implied that they worked for the KGB, the doctors were fearful of what would happen if they said no to a KGB operative and said their intention was only to help heal the sick and treat the wounded, arguing that this was a crime created by the U.S. government. The prosecution argued that the two doctors wanted to be long-term weapons for Russia and there was no merit to the claims they were entrapped by the FBI.

After two and a half days of deliberation, the jury told U.S. District Court Judge, Stephanie Gallagher, that they were unable to reach a unanimous verdict because one juror believed the doctors were entrapped by the FBI, leaving Gallagher with no option other than to declare a mistrial. The U.S. Attorney’s Office has confirmed that it will seek a retrial.

The post Mistrial Declared in Criminal HIPAA Prosecution of Couple Who Disclosed PHI to Undercover FBI Agent appeared first on HIPAA Journal.

$30,000 Penatly for Disclosing PHI Online in Response to Negative Reviews

Posted June 6, 2023 by Steve Alder

The Department of Health and Human Services’ Office for Civil Rights (OCR) has agreed to settle a HIPAA violation case with a New Jersey provider of adult and child psychiatric services for $30,000. In April 2020, OCR received a complaint alleging Manasa Health Center had impermissibly disclosed patient information online when responding to a negative online review. The complainant alleged Manasa Health Center’s responded to a patient’s review and disclosed the patient’s mental health diagnosis and treatment information.

OCR launched an investigation into the Kendall Park, NJ-based healthcare provider and discovered the protected health information of a total of four patients had been impermissibly disclosed in responses to negative Google Reviews, and notified the practice about the HIPAA Privacy Rule investigation on November 18, 2020. In addition to the impermissible disclosures of PHI, which violated 45 C.F.R. § 164.502(a) of the HIPAA Privacy Rule, the practice was determined to have failed to comply with standards, implementation specifications, or other requirements of HIPAA Privacy Rule and Breach Notification Rules – 45 C.F.R. § 164.530(i).

Manasa Health Center chose to settle the case with OCR with no admission of liability or wrongdoing. In addition to the financial penalty, Manasa Health Center has agreed to adopt a corrective action plan which includes the requirement to develop, maintain, and revise its written policies and procedures to ensure compliance with the HIPAA Privacy Rule, provide training to all members of the workforce on those policies and procedures, issue breach notification letters to the individuals whose PHI was impermissibly disclosed online, and submit a breach report to OCR about those disclosures.

This is not the first time that OCR has imposed a financial penalty for disclosures of PHI on social media and online review platforms. In 2022, OCR agreed to a $23,000 settlement with New Vision Dental and imposed a civil monetary penalty of $50,000 on Dr. U. Phillip Igbinadolor, D.M.D. & Associates, P.A. In 2019, OCR settled an online disclosure case with Elite Dental Associates for $10,000. The HIPAA Privacy Rule does not prohibit HIPAA-regulated entities from responding to online reviews or using social media; however, protected health information must not be disclosed online without written consent from the patient. You can read more about HIPAA and social media here.

“OCR continues to receive complaints about health care providers disclosing their patients’ protected health information on social media or on the internet in response to negative reviews. Simply put, this is not allowed,” said OCR Director Melanie Fontes Rainer. “The HIPAA Privacy Rule expressly protects patients from this type of activity, which is a clear violation of both patient trust and the law. OCR will investigate and take action when we learn of such impermissible disclosures, no matter how large or small the organization.”

This is the 5th OCR HIPAA enforcement action in 2023 that has been resolved with a financial penalty. So far this year, $1,661,500 has been paid by HIPAA-regulated entities to resolve violations of the HIPAA Rules.

The post $30,000 Penatly for Disclosing PHI Online in Response to Negative Reviews appeared first on HIPAA Journal.

Arizona Man Sentenced to 54 Months in Criminal HIPAA Violation Case

Posted June 2, 2023 by Steve Alder

An Arizona man has been sentenced to 54 months in jail for aggravated identity theft and criminal violations of the Health Insurance Portability and Accountability Act (HIPAA). Rico Prunty, 41 years old, of Sierra Vista, Arizona, was previously employed at an Arizona medical facility where he unlawfully accessed the medical intake forms of patients between July 2014 and May 2017. The intake forms included information protected under HIPAA such as names, dates of birth, addresses, employer information, social security numbers, diagnoses, and medical information.

He then provided that information to his co-conspirators – Vincent Prunty, Temika Coleman, and Gemico Childress – who used the stolen information to open credit card accounts in the victims’ names. Federal prosecutors investigating the identity theft raided an apartment linked to the suspects and found evidence of the manufacture of credit cards and the opening of fraudulent accounts in victims’ names. Prunty and his co-conspirators attempted to steal more than $181,000 from the victims.

According to court documents, the protected health information of almost 500 patients was accessed without authorization, and their information was impermissibly disclosed to Prunty’s co-conspirators. Rico Prunty pleaded guilty to aggravated identity theft and criminal HIPAA violations for accessing and disclosing patients’ protected health information. The HIPAA violations carried a maximum jail term of 10 years, and aggravated identity has a mandatory sentence of 2 years, which runs consecutively to sentences for other felony crimes. Senior U.S. District Court Judge James Moody imposed a sentence of 54 months with 2 years of supervised release and Prunty was ordered to pay $132,521.98 in restitution to the victims.

His co-conspirators have already been sentenced for their roles in the identity theft scheme. Vincent Prunty pleaded guilty to wire fraud, mail fraud, and aggravated identity theft and was sentenced to 154 months, Gemico Childress pleaded guilty to wire fraud and aggravated identity theft and was sentenced to 134 months, and Temika Coleman pleaded guilty to wire fraud, mail fraud, and aggravated identity theft and was sentenced to 121 months. They were also ordered to pay $181,835.77 in restitution and will each have 2 years of supervised release.

The post Arizona Man Sentenced to 54 Months in Criminal HIPAA Violation Case appeared first on HIPAA Journal.

Doctor Fined for Privacy Violations Following Abortion on 10-Year-Old Rape Victim

Posted May 26, 2023 by Steve Alder

Dr. Caitlin Bernard, an Indianapolis, IN-based obstetrician-gynecologist has been fined $3,000 by the Medical Licensing Board of Indiana and issued with a letter of reprimand for violating HIPAA and state privacy law after talking to the media about an abortion she provided to a 10-year-old rape victim on July 1, 2022.

Within hours of the Supreme Court’s decision that overturned Roe v Wade and removed the federal right to an abortion, Ohio banned abortions after 6 weeks of pregnancy. Three days later, on June 27, 2022, Dr. Bernard received a call from a child abuse doctor in Ohio about a 10-year-old patient who could not legally have an abortion in Ohio as she was three days past the legal cutoff. The victim then traveled from her home state of Ohio to Indiana to have the procedure performed by Dr. Bernard.

A reporter for the IndyStar overheard a conversation between Dr. Bernard and another doctor at an anti-abortion rally and approached Dr. Bernard and asked for comment. The IndyStar ran a story about the girl and the reduction of access to abortions following the Supreme Court’s decision, and the story rapidly became national news. The case was also referenced on multiple occasions by President Biden. Following the publication of the story, Dr. Bernard provided further statements to the media, was interviewed on national TV networks, and was featured in various media articles, in which Dr. Bernard highlighted the real-world impact of the change to federal law on abortions. In those media interviews, Dr. Bernard confirmed that she had performed an abortion procedure on a 10-year-old patient, but did not disclose the name of the patient.

Shortly after the publication of the IndyStar story, Indiana Attorney General Todd Rokita confirmed in a Fox News interview that Dr. Bernard would be investigated. Rokita filed an administrative complaint with the Medical Licensing Board of Indiana alleging Dr. Bernard had violated HIPAA and state law by failing to get written authorization to release patient information, and that Dr. Bernard had failed to immediately report suspected child abuse to local law enforcement in Indianapolis or the Indiana Department of Children Services. Rokita claimed that Dr. Bernard learned about possible child abuse on June 27, 2022, in a telephone call, yet failed to report it until July 2, 2022, the day after the procedure was performed. As such, the child was returned to the custody of the alleged rapist, where she remained until July 6, 2022. Law enforcement later confirmed, with a 99.99% probability, that the rapist was the child’s biological father, who was charged with two counts of rape in July 2022.

In a Medical Licencing Board hearing on Thursday, Dr. Bernard’s attorney explained that Dr. Bernard told an IU Health social worker about the case on the same day she received the initial call about the patient, and that discussion was in line with IU Health’s policies. She also confirmed that the abuse was reported on an Indiana state form and that the abuse had already been reported in Ohio where the abuse took place. The IU Health social worker testified that she reported the abuse in Ohio per IU Health policies, as that was where the abuse occurred. Dr. Bernard also confirmed with child protection staffers in Ohio that it was safe for the child to leave with her mother and testified that she did not violate state or federal privacy laws as she did not disclose any identifying information about the patient.

At the hearing, Deputy Attorney General Cory Voight asked Dr. Bernard why she had disclosed information about a real patient, rather than providing a hypothetical situation in her media interviews. “I think that it’s incredibly important for people to understand the real-world impacts of the laws of this country about abortion,” said Dr. Bernard in response. “I think it’s important for people to know what patients will have to go through because of legislation that is being passed, and a hypothetical does not make that impact.”

Andrew Mahler, a former official at the HHS’ Office for Civil Rights was an expert witness for the state and testified that the disclosures made by Dr. Bernard violated HIPAA, as it was certainly possible that the information disclosed by Dr. Bernard – age, state, and gender – would allow the girl to be identified. Paige Jayner, a privacy compliance officer and former OCR auditor, was a witness for the defense and disagreed with Mahler’s view, testifying that the information Dr. Bernard disclosed was not protected health information and that the disclosure was not a HIPAA violation. IU Health agreed and did not believe the HIPAA Rules had been violated. At the hearing, Dr. Bernard defended her right to speak to the media about medical issues when it is in the public interest and her attorney confirmed that there are no laws that prohibit physicians from speaking with the media.

Dr. John Strobel, President of the Medical Licensing Board believed Dr. Bernard disclosed too much information to the IndyStar reporter about the pending abortion and said consent should have been obtained before any information was disclosed. The majority decision of the Medical Licensing Board was the disclosures violated state and federal privacy laws and Dr. Bernard received a $1,000 fine for each of the three privacy violation counts. The Medical Licensing Board found the state had failed to meet the burden for the other two counts on reporting the child abuse and Dr. Bernard being unfit to practice, and therefore did not suspend Dr. Bernard or put her on probation so she is able to continue to practice in Indiana. Dr. Bernard will be given the right to appeal the decision.

The post Doctor Fined for Privacy Violations Following Abortion on 10-Year-Old Rape Victim appeared first on HIPAA Journal.

Daily HIPAA News, HIPAA RSS Feeds, HIPAA Information