HHS recently announced that Lahey Hospital and Medical Center (Lahey) has agreed to pay $850,000 and will adopt a robust corrective action plan to correct deficiencies in its HIPAA compliance program.
According to the HHS announcement, Lahey notified The Office of Civil Rights (OCR) that a laptop was stolen from an unlocked treatment room during overnight hours. The laptop was accompanied by a portable CT scanner that produced images for viewing through Lahey's Radiology Information System and Picture Archiving and Communication System. The laptop hard drive contained protected health information (PHI) of 599 individuals.
The OCR investigation revealed:
- Failure to conduct a thorough risk analysis of all of its ePHI;
- Failure to physically safeguard a workstation that accessed ePHI;
- Failure to implement and maintain policies and procedures regarding the safeguarding of ePHI maintained on workstations utilized in connection with diagnostic/laboratory equipment;
- Lack of a unique user name for identifying and tracking user identity with respect to the workstation at issue in this incident;
- Failure to implement procedures that recorded and examined activity in the workstation at issue in this incident; and
- Impermissible disclosure of 599 individuals' PHI.
"Because these workstations often contain ePHI and are highly portable, such ePHI must be considered during an entity's risk analysis, and entities must ensure that necessary safeguards that conform to HIPAA's standards are in place," said OCR Director Jocelyn Samuels.
Lahey will be required to pay $850,000, address its history of noncompliance with HIPAA Rules by providing OCR with a comprehensive, enterprise-wide risk analysis and corresponding risk management plan, and provide evidence of compliance.
What we can learn From Lahey:
In the press release, OCR Director Jocelyn Samuels strongly directs covered entities to protect ePHI found in portable workstations and computers connected to medical equipment. Please take into consideration that access controls and data authentication (HCP training includes policies / procedures for both) would have been excellent ways for Lahey to protect ePHI. Also consider the fact that the laptop was not in a secure location. Had the laptop been secured, the breach could have been easily prevented.
Click Mobile Device(s) Policy and Procedures to learn more from HCP about the importance of securing mobile devices.
If you have any questions please do not hesitate to contact one of our professional consultants.