[{"innerBlocks":[],"name":"core\/freeform","postId":1273,"blockType":{"name":"core\/freeform","keywords":[],"attributes":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"}},"providesContext":[],"usesContext":[],"selectors":[],"supports":{"className":false,"customClassName":false,"reusable":false},"styles":[],"variations":[],"apiVersion":3,"title":"Classic","description":"Use the classic WordPress editor.","category":"text"},"originalContent":"Last year, the Department of Health and Human Services\u2019 Office for Civil Rights set an all-time record for HIPAA enforcement activity in terms of overall dollar value of its fines, according to HHS.

OCR racked up a total of $28.7 million in enforcement actions<\/a> in 2018, including 10 settlements and a summary judgment in a case before an administrative law judge. The agency beat the previous record of $23.5 million in 2016 by 22 percent.

\u201cOur record year underscores the need for covered entities to be proactive about data security if they want to avoid being on the wrong end of an enforcement action,\u201d says Roger Severino, director of OCR.

In 2018, OCR also reported the single largest individual HIPAA settlement in history of $16 million with Anthem\u2014a nearly three-fold increase over the previous record settlement of $5.5 million in 2016.

Also See<\/b>: OCR levies $16M fine on Anthem for large 2015 breach<\/a>

The year\u2019s final settlement\u2014this past December\u2014involved Cottage Health, a Santa Barbara, Calif.-based not-for-profit healthcare system, which agreed to pay $3 million to OCR and to adhere to a corrective action plan to settle potential violations of the HIPAA rules.

The Cottage Health case<\/a> involved two breaches of unsecured electronic protected health information (ePH)\u2014one in December 2013 and the other in December 2015\u2014which affected more than 62,500 individuals.

According to OCR, its investigation found the following failures on the part of Cottage Health:

It didn\u2019t conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of the ePHI.
<\/li>
The organization failed to implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level.
<\/li>
It didn\u2019t perform periodic technical and non-technical evaluations in response to environmental or operational changes affecting the security of ePHI.
<\/li>
Cottage Health failed to obtain a written business associate agreement with a contractor that maintained ePHI on its behalf.
<\/li><\/ul>\u201cThe Cottage settlement reminds us that information security is a dynamic process and the risks to ePHI may arise before, during, and after implementation covered entity makes system changes,\u201d adds OCR\u2019s Severino.","saveContent":"Last year, the Department of Health and Human Services\u2019 Office for Civil Rights set an all-time record for HIPAA enforcement activity in terms of overall dollar value of its fines, according to HHS.

OCR racked up a total of $28.7 million in enforcement actions<\/a> in 2018, including 10 settlements and a summary judgment in a case before an administrative law judge. The agency beat the previous record of $23.5 million in 2016 by 22 percent.

\u201cOur record year underscores the need for covered entities to be proactive about data security if they want to avoid being on the wrong end of an enforcement action,\u201d says Roger Severino, director of OCR.

In 2018, OCR also reported the single largest individual HIPAA settlement in history of $16 million with Anthem\u2014a nearly three-fold increase over the previous record settlement of $5.5 million in 2016.

Also See<\/b>: OCR levies $16M fine on Anthem for large 2015 breach<\/a>

The year\u2019s final settlement\u2014this past December\u2014involved Cottage Health, a Santa Barbara, Calif.-based not-for-profit healthcare system, which agreed to pay $3 million to OCR and to adhere to a corrective action plan to settle potential violations of the HIPAA rules.

The Cottage Health case<\/a> involved two breaches of unsecured electronic protected health information (ePH)\u2014one in December 2013 and the other in December 2015\u2014which affected more than 62,500 individuals.

According to OCR, its investigation found the following failures on the part of Cottage Health:

It didn\u2019t conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of the ePHI.
<\/li>
The organization failed to implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level.
<\/li>
It didn\u2019t perform periodic technical and non-technical evaluations in response to environmental or operational changes affecting the security of ePHI.
<\/li>
Cottage Health failed to obtain a written business associate agreement with a contractor that maintained ePHI on its behalf.
<\/li><\/ul>\u201cThe Cottage settlement reminds us that information security is a dynamic process and the risks to ePHI may arise before, during, and after implementation covered entity makes system changes,\u201d adds OCR\u2019s Severino.","order":0,"get_parent":{},"attributes":[],"attributesType":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"}},"dynamicContent":""}]

OCR sets record in 2018 for HIPAA enforcement actions

More for you