If you are not monitoring access logs on your computer system on a regular basis to see who is accessing what PHI and why, CMS is very likely to conclude you aren’t doing your job under HIPAA. That is especially true if you miss the fact that a former employee is still accessing PHI in … Read more
The US DHS Office of Civil Rights has announced the second HIPAA fine of the year, with a whopping $2.2 million dollar settlement against a Puerto Rico based life insurance company known as MAPFRE Life, a subsidiary company of MAPFRE S.A., a global multinational insurance company headquartered in Spain. MAPFRE underwrites and administers a variety … Read more
Mold deaths that resulted in a temporary shutdown of the UPMC (University of Pittsburgh Medical Center) transplant program may be linked to mold-contaminated linens according to local news reports http://triblive.com/local/allegheny/11848341-74/upmc-paris-report. So what could client hospitals do to reduce their risk to such a litigation exposure? We asked Mike Rautmann, insurance industry expert and healthcare team … Read more
The U.S. Department of Health and Human Services, Office for Civil Rights (OCR), has announced a Health Insurance Portability and Accountability Act of 1996 (HIPAA) civil money penalty against Children’s Medical Center of Dallas (Children’s) based on its impermissible disclosure of unsecured electronic protected health information (ePHI) and non-compliance over many years with multiple standards … Read more
A Georgia hospital, doctor, and ambulance company have been sued for allegedly sending a family member more than 300 miles to a nursing home following discharge from the hospital. According to reports published by the Augusta Chronicle, the patient was admitted to a hospital from a nearby nursing home with a condition of sepsis and … Read more
A new target may be added to the current wave of ADA lawsuits against hospitals, if a recent AZ suit is an indication — or perhaps more accurately, a storm warning. The serial lawsuit business has taken a new turn when a lawsuit was filed alleging that various Phoenix area businesses were violating ADA requirements … Read more
Illinois’ Presence Health Network found out in a big way in a December 29, 2016 settlement with the HIPAA enforcement unit of Office of Civil Rights for the sun of $475,000. While the settlement does not admit wrong-doing, the settlement agreement released by OCR states the grounds are allegations of a delay in breach notifications … Read more
Alert: Phishing Email Disguised as Official OCR Audit Communication November 28, 2016 It has come to our attention that a phishing email is being circulated on mock HHS Departmental letterhead under the signature of OCR’s Director, Jocelyn Samuels. This email appears to be an official government communication, and targets employees of HIPAA covered entities and … Read more
It does not take a huge breach of privacy to result in a huge fine — in this case, malware that potentially compromised 1670 patient files of PHI cost UMASS $650,000 in fines. This emphasizes the concept that there is no such thing as a “small breach” of PHI. The OCR announcement of the fine … Read more
Reminder – EMTALA reality: Since the dawn of EMTALA I have been telling people that one of the biggest compliance problems with the law is that nobody reads the definitions. Later when the regulations and site review guidelines (State Operations Manual) came out, the second big set of “definitions” were included in the law through … Read more