The managed care plan, Affinity Health Plan, Inc. (“Affinity”) received notification of the alleged breach from a CBS Evening News representative, who as part of a CBS investigation, had purchased a photocopier previously leased by Affinity. CBS discovered protected health information (PHI) remained on the photocopier’s hard drive. Affinity estimated that as many as 344, 579 persons may have been affected by the breach. Pursuant to the Breach Notification Rule, promulgated under the Health Information Technology for Economic and Clinical Health (HITECH) Act, Affinity filed a breach report with OCR in April 2010.
Upon
investigation by OCR, it was determined that Affinity had returned leased
photocopiers without erasing (or destroying, i.e., rendering unusable,
unreadable, or indecipherable) the information contained on the photocopier’s
hard drives, which included patients’ PHI.
It was also determined that Affinity had not incorporated the data on
the photocopiers in its Security Risk Assessment as required under the HIPAA
Security Rule, nor did it implement appropriate HIPAA policies and procedures,
such that the PHI would have been destroyed when returning the
photocopiers. Therefore, in addition to
the large settlement payment, as part of its Corrective Action Plan, it must
also take additional measures to safeguard all electronic PHI (ePHI), including
using its “best efforts” to locate all photocopier hard drives previously
leased. Affinity’s Resolution Agreement and Corrective Action Plan can be found
on the OCR website at: http://www.hhs.gov/ocr/privacy/hipaa/enforcement/examples/affinity-agreement.html.
So what does this all mean? First, as we have mentioned before, the HIPAA Compliance deadline is looming within the next month (September 23, 2013). Do you qualify as a HIPAA covered entity? If yes, does your practice have HIPAA policies and procedures in place, which have been updated since the issuance of the HIPAA “Final Rule” in January 2013? Do these policies include a Security Risk Assessment to be performed on a regular basis? We recommend such an Assessment be performed at least annually, and would include confirming procedures regarding the return or retirement of electronic media AND the destruction of ePHI so that it is rendered unusable, unreadable, and indecipherable.
As evidenced by Affinity’s corrective
action plan with OCR, HIPAA breaches are a serious, and expensive matter, with
penalties ranging up to $1.5 million, per
violation. If your practice
qualifies as a HIPAA covered entity, please contact Susan Ziel at sziel@kdlegal.com,
or Jaya White at jwhite@kdlegal.com, to learn more about how our firm can assist you to achieve
full compliance with the Final
Rule requirements in advance of the September 23, 2013 compliance deadline.