A physical therapy center and another healthcare organization have paid the U.S. Department of Health and Human Services Office for Civil Rights (OCR) almost $2 million collectively to resolve potential violations of the Health Insurance Portability and Accountability Act (HIPAA). According to a notice on HHS’ website, these major enforcement actions underscore the significant risk to the security of patient information posed by unencrypted laptop computers and other mobile devices.
The OCR opened a compliance review of Concentra Health Services upon receiving a breach report that an unencrypted laptop was stolen from one of its facilities, the Springfield, Mo., Physical Therapy Center.
OCR’s investigation revealed that Concentra had previously recognized in multiple risk analyses that a lack of encryption on its laptops, desktop computers, medical equipment, tablets and other devices containing electronic protected health information (ePHI) was a critical risk. Although steps were taken to begin encryption, Concentra’s efforts were incomplete and inconsistent over time, leaving patient PHI vulnerable throughout the organization, the investigation found. The OCR’s investigation further found Concentra had insufficient security management processes in place to safeguard patient information.
Concentra has agreed to pay OCR more than $1.7 million to settle potential violations and will adopt a corrective action plan to evidence their remediation of these findings.
Additionally, the OCR received a breach notice in February 2012 from QCA Health Plan of Arkansas reporting that an unencrypted laptop computer containing the ePHI of 148 individuals was stolen from a workforce member’s car. Although QCA encrypted its devices following discovery of the breach, the OCR’s investigation revealed that QCA failed to comply with multiple HIPAA requirements beginning from the compliance date of the security rule in April 2005 and ending in June 2012.
QCA agreed to a $250,000 monetary settlement and is required to provide HHS with an updated risk analysis and corresponding risk management plan that includes specific security measures to reduce the risks to and vulnerabilities of its ePHI. QCA also is required to retrain its workforce and document its ongoing compliance efforts.
“Covered entities and business associates must understand that mobile device security is their obligation,” Susan McAndrew, OCR’s deputy director of health information privacy, said in the HHS announcement. “Our message to these organizations is simple: encryption is your best defense against these incidents.”