nurse hipaa violation cases nurse hipaa violation cases

Data were accessed by unknown third parties after ePHI data was unwittingly transferred to a server accessible to the public. The firewall was inactive for a period of 10 months leaving the data exposed and potentially accessible to unauthorized third parties for an unacceptable period of time. OCR received a complaint from a patient alleging BILHBS had not provided a copy of her fathers medical records. The practice trained all staff on the newly developed policies and procedures. Read More, The HHS has announced that Lahey Hospital and Medical Center has agreed to settle a case with the Office for Civil Rights over alleged HIPAA violations following a data breach that occurred in October 2011. However, the court also legitimized private cause for action in HIPAA lawsuits, which could set a precedent for HIPAA related legal action. Nurse Pleads Guilty to HIPAA Violation A licensed practical nurse who pled guilty to wrongfully disclosing a patient's health information for personal gain faces a maximum penalty of 10 years imprisonment, a $250,000 fine or both. The case was settled for $70,000. A radiology practice that interpreted a hospital patients imaging tests submitted a workers compensation claim to the patients employer. Not necessary. The hacker stole data, attempted to extort money, and leaked the ePHI of 208,557 patients online when payment was not received. Scott Harris and the rest of our team at S J Harris Law will be ready to help you pursue any option available that allows you to keep your license and continue working, no matter what industry you are in. In nursing education, a HIPAA violation made by a nursing student could result in a variety of disciplinary actions including termination but is rarely discussed in nursing literature. The case was settled for $6,850,000. After OCR intervened, the records were provided, but it took 22 months from the initial date of the request. All Case Examples. The data breach investigation revealed a substandard security management process and a catalog of HIPAA Security Rule violations. Private Practice Revises Access Procedure to Provide Access Despite an Outstanding Balance Between October 23, 2009, and March 7, 2010 part of its database of policyholders was accessible to unauthorized individuals. The OCR investigation revealed a lack of business associate agreements, insufficient access rights, a risk analysis failure, a failure to respond to a security incident, a breach notification failure, media notification failure. A good example of this is a laptop that is stolen. HIPAA Violation Case Settled Between Ambulance Company & OCR for $65,000. If an organization fails to take corrective action after having been issued a fine, the HHS Office of Civil Rights can impose subsequent fines. Read more, In 2015, Excellus Health Plan reported a breach of the ePHI of 9,358,891 individuals. Read more, The California-based psychiatric medical services provider failed to provide a patient with timely access to the requested medical records and charged an unreasonable fee when the records were eventually provided. The case was settled for $25,000. During OCRs investigation, the physician confirmed that the complainant was not given access to her medical record because of the outstanding balance. Read More, Puerto Rico Blue Cross Blue Shield licensee Triple S Management Corporation has agreed to pay a HIPAA violation fine of $3.5 million to the Department of Health and Human Services Office for Civil Rights. Read More, Raleigh Orthopaedic Clinic, P.A., of North Carolina over alleged violations of HIPAA Rules. District of Ohio dismissed her case. Covered Entity: Private Practice Among the corrective actions required to resolve this case, OCR required the insurer to correct the flaw in its computer system, review all transactions for a six month period and correct all corrupted patient information. Triple S was also required to pay a HIPAA violation penalty of $6.8 million to the Puerto Rico Health Insurance Administration for a failure to comply with the Health Insurance Portability and Accountability Acts Privacy Rule last year, although the HIPAA violation fine was reduced to $1.5 million on appeal. The patient had requested a copy of her childs fetal heart monitor records, but 9 months after the request had been submitted the records still had not been provided. Now add up that time for a week, a month, or even a year. Cancel Any Time. Read More, The solo dental practitioner in Butler, PA, failed to provide a patient with a copy of their medical record in a timely manner. HIPAA Journal provides the most comprehensive coverage of HIPAA news anywhere online, in addition to independent advice about HIPAA compliance and the best practices to adopt to avoid data breaches, HIPAA violations and regulatory fines. Read More, An article published in the LA Times started a sequence of events that has now resulted in Shasta Regional Medical Center (SRMC) agreeing to a settlement of $275,000 for its violations of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule. As a result of this review, the hospital revised the distribution of the OR schedule, limiting it to those who have a need to know., Private Practice Ceases Conditioning of Compliance with the Privacy Rule The Privacy Rule requires covered entities to provide individuals with access to their medical records; however, the Privacy Rule exempts psychotherapy notes from this requirement. Issue: Impermissible Disclosure. Issue: Impermissible Uses and Disclosures; Authorizations. Private Practice Implements Safeguards for Waiting Rooms Read more, Dr. Robert Glaser, a New Hyde Park, NY-based cardiovascular disease and internal medicine doctor, failed to provide a patient with timely access to the requested medical records after repeated requests. Read More, Coastal Ear, Nose, and Throat in Florida received a request from a patient for a copy of medical records on December 15, 2020, and again on January 8, 2021, but the records were not provided until May 20, 2021. The infection resulted in the impermissible disclosure of the electronic protected health information of 1,670 individuals. By Jill McKeon. Read more, Childrens Hospital & Medical Center (CHMC), a pediatric care provider in Omaha, Nebraska, received a request from a parent for access to her daughters medical records but only provided part of the requested information, despite repeated requests. Maybe PHI was in the background unknowingly. A violation of HIPAA attributable to ignorance can attract a fine of $100 - $50,000. A violation that occurred despite reasonable vigilance can attract a fine of $1,000 $50,000. Issue: Access. HIPAA violation penalties are tiered based on the level of negligence determined by the Department of Health and Human Services or the state attorney general. Improper Disposal HIPAA rules state medical professionals must dispose of PHI in a secure manner. OCR intervened and the records were provided 8 months after the initial request. OCR also identified issues with the notice of privacy practices and there was no HIPAA privacy officer. Among other corrective actions to resolve the specific issues in the case, the HMO created a new HIPAA-compliant authorization form and implemented a new policy that directs staff to obtain patient signatures on these forms before responding to any disclosure requests, even if patients bring in their own authorization form. This usually happens when a celebrity checks into the hospital, but that's not always the case. The Center for Childrens Digestive Health (CCDH); a small 7-center pediatric subspecialty practice based in Park Ridge, Illinois has agreed to pay OCR $31,000 to resolve potential HIPAA violations. The minimum fines are $100 per violation for tier 1, $1,000 per violation for tier 2, $10,000 per violation for tier 3, and $50,000 per violation for tier 4. To resolve this matter, the covered entity refunded the $100.00 records review fee., Hospital Issues Guidelines Regarding Disclosures to Avert Threats to Health or Safety Hospital Revises Email Distribution as a Result of a Disclosure to Persons Without a "Need to Know" Read More, Office for Civil Rights has agreed to its largest-ever financial penalty for a violation of the Health Insurance Portability and Accountability Acts Privacy and Security Rules. OCR settled the case for $65,000. The complainant alleged that a mental health center (the "Center") improperly provided her records to her auto insurance company and refused to provide her with a copy of her medical records. Under the Notice of Enforcement Discretion, the maximum annual penalty for a violation could be capped at $25,000 for tier 1, $100,000 for tier 2, and $250,000 for tier 3. The patient filed a complaint with OCR and the records were eventually provided more than 10 months later. The investigation confirmed there had been a HIPAA Right of Access failure. Anthem agreed to a record-breaking settlement of $16,000,000 to resolve the case. Covered Entity: Health Plans Nurses who deliberately obtain or disclose individually identifiable protected health information can face a fine of up to $50,000 and a maximum of 12 months in jail. A nurse in a New York clinic found herself at the center of an ugly HIPAA violation case when her sister-in-law's boyfriend was diagnosed with an STD. 200 Independence Avenue, S.W. Violations related to HIPAA laws have serious consequences, including job loss and other penalties. OCR determined the failure to terminate access rights when employment had ended was in violation of the HIPAA Security Rule. Another way to prevent HIPAA violations on social media is to get proper compliance training for your staff. The device contained a range of patients ePHI, including full names, Social Security numbers, and dates of birth. Delaware Co. June 5, 2012). The employee responsible for the disclosure received a written disciplinary warning, and both the employee and the physician apologized to the patient. In 2014, hackers accessed its systems and stole the ePHI of 6,121,158 individuals. Read More, Office for Civil Rights has announced a settlement of $1,215,780 has been reached with Affinity Health Plan, Inc., to resolve potential HIPAA violations discovered during a breach investigation. OCRs investigation revealed periodic technical and non-technical evaluations of operational changes affecting the security of their electronic PHI had not been performed, procedures had not been implemented to verify the identity of individuals accessing their ePHI, there was a lack of ePHI safeguards, and Aetna had violated the minimum necessary standard. OCR determined this breached the HIPAA Right of Access provision of the HIPAA Privacy Rule. Read More, Hillcrest Nursing and Rehabilitation in Massachusetts received a request from a parent for her sons medical records onMarch 22, 2020, but the records were not provided until October 10, 2020. Read More, The Californian general dental practice, New Vision Dental, was investigated by OCR following reports about impermissible disclosures of patients protected health information on the review platform Yelp. Read More, The Department of Health and Human Services Office for Civil Rights (OCR) has taken action against a Denver, CO-based federally-qualified health center (FQHC) for security management process failures that contributed to the organization experiencing a data breach in 2011. OCR intervened and provided technical assistance on the HIPAA Right of Access but received a second complaint when the records had still not been provided. A settlement of $500,000 was agreed upon to resolve the alleged HIPAA violations. Read More, An OCR investigation into an impermissible disclosure of 9,255 individuals PHI by Advanced Care Hospitalists, a business associate of a HIPAA-covered entity, revealed serious HIPAA compliance failures including a lack of a BAA, insufficient security measures to protect ePHI, and no documentation showing there had been any HIPAA compliance efforts prior to April 1, 2014. Detailed below is a summary of all HIPAA violation cases that have resulted in settlements with the Department of Health and Human Services Office for Civil Rights (OCR), including cases that have been pursued by OCR after potential HIPAA violations were discovered during data breach investigations, and investigations of complaints submitted by patients and healthcare employees. Read More, OCR launched an investigation of University of Rochester Medical Center following receipt of two breach reports concerning lost/stolen portable devices containing ePHI a flash drive and a laptop computer. Covered Entity: Outpatient Facility OCR provided technical assistance to the covered entity, explaining that the Privacy Rule permits a covered entity to provide a summary of patient records rather than the full record only if the requesting individual agrees in advance to such a summary or explanation. Issue: Minimum Necessary; Confidential Communications. Covered Entity: Health Care Provider Read More, OCR agreed to settle multiple alleged HIPAA violations with Cottage Health for $3,000,000. The revised policy was implemented in the chains' stores nationwide. The previous record was the $3.5 million settlement with Triple S Management Corporation agreed in November 2015. The HIPAA Right of Access violation was settled with OCR for $30,000. The Privacy Rule permits the imposition of a reasonable cost-based fee that includes only the cost of copying and postage and preparing an explanation or summary if agreed to by the individual. the practice settled the case with OCR for $80,000. OCRs investigation revealed that the radiology practice had relied upon incorrect billing information from the treating hospital in submitting the claim. Unprotected storage of private health information can be an issue. The man sued the clinic, even though it had already dismissed the nurse from her job. Issue: Notice. > All Case Examples, Hospital Implements New Minimum Necessary Polices for Telephone Messages }); Show Your Employer You Have Completed The Best HIPAA Compliance Training Available With ComplianceJunctions Certificate Of Completion, Learn about the top 10 HIPAA violations and the best way to prevent them, Avoid HIPAA violations due to misuse of social media, Losses to Phishing Attacks Increased by 76% in 2022, Biden Administration Announces New National Cybersecurity Strategy, Settlement Reached in Preferred Home Care Data Breach Lawsuit, BetterHelp Settlement Agreed with FTC to Resolve Health Data Privacy Violations, Amazon Completes Acquisition of OneMedical Amid Concern About Uses of Patient Data, Willful neglect (not corrected within 30 days. A staff member of a medical practice discussed HIV testing procedures with a patient in the waiting room, thereby disclosing PHI to several other individuals. > Case Examples Documentation was uncovered that clearly showed that mobile devices were believed to represent a critical security risk, yet action was not taken to address this issue in time to prevent the data breach. Read More, Lawrence Bell, Jr. D.D.S in Maryland failed to provide a patient with timely access to the requested medical records. The HIPAA Right of Access violation was settled with OCR for $5,000. Read More, Washington, NC-based Metropolitan Community Health Services is a Federally Qualified Health Center. Read More, Catholic Health Care Services of the Archdiocese of Philadelphia has agreed to settle alleged HIPAA violations with the OCR and implement a Corrective Action Plan (CAP). These cases include civil monetary penalties, where it has been established that HIPAA Rules have been violated, and settlements, where HIPAA violations have been alleged to have occurred but the covered entity or business associate has decided not to contest the case and has instead chosen to pay a financial penalty to resolve the potential HIPAA violations with no admission of liability. Read More, In March 2019, OCR received a complaint from a patient who alleged she had not been provided with a copy of her medical records in the requested electronic format despite making repeated requests. OCR determined its compliance program had been in disarray for several years. An OCR investigation also indicated that the confidential communications requirements were not followed, as the employee left the message at the patients home telephone number, despite the patients instructions to contact her through her work number. A settlement of $1,700,000 has been agreed upon with OCR to resolve the HIPAA violations that contributed to the cause of the breach. And when data breaches like this occur, it's usually because of a HIPAA violation. In addition, OCR required the practice to reposition its computer monitors to prevent patients from viewing information on the screens, and the practice installed computer monitor privacy screens to prevent impermissible disclosures. For one violation, fines can range from $100-$50,000 for each instance of wrongdoing. An Accusation is a legal document formally charging a registered nurse with a violation (s) of the Nursing Practice Act, and notifying the public that a disciplinary action is pending against that nurse. Issue: Impermissible Uses and Disclosures. The first bar in the group of three per year represents the complaints closed in which there was no violation, the second in which there was corrective action, and the third reflects the total closures. Read More, Housing Works, Inc. is a New York City-based non-profit healthcare organization that provides healthcare, homeless services, and legal aid support for people affected by HIV/AIDS. Therefore you should assess employees security awareness as part of a risk analysis to see if more training is required. The case was settled for $2.175 million. Issue: Conditioning Compliance with the Privacy Rule. Read More, QCA Health Plan, Inc. of Arkansas reported the theft of a laptop from a car that contained unencrypted data on 148 patients. To resolve this matter, OCR also required the practice to revise its policies and operating procedures and to move medical alert stickers to the inside cover of the records. Read More, Anchorage Community Mental Health Services (ACMHS) runs five mental health facilities in Alaska and is a non-profit organization. in Chicago, Illinois, was investigated in response to a complaint from a patient who had only been provided with a partial copy of her requested medical records. Pharmacy Chain Enters into Business Associate Agreement with Law Firm The case was settled and a financial penalty of $28,000 was paid. The HHS` Office of Civil Rights receives between 1,200 and 1,500 complaints and notifications of breaches per year. A case study involving one nursing education program's experience with a Health Insurance Portability and Accountability Act (HIPAA) violation is used to illustrate how one nursing. OCR's investigation confirmed that the use and disclosure of protected health information by the supervisor was not authorized by the employee and was not otherwise permitted by the Privacy Rule. In response to OCRs investigation, the mental health center acknowledged that it had not provided the complainant and his daughter with a notice prior to her mental health evaluation. To resolve this matter, the mental health center revised its intake assessment policy and procedures to specify that the notice will be provided and the clinician will attempt to obtain a signed acknowledgement of receipt of the notice prior to the intake assessment. All rights reserved. The case was settled for $36,000. An OCR investigation indicated that the form the HMO relied on to make the disclosure was not a valid authorization under the Privacy Rule. The settlement for HIPAA violations was reached with SEMC for violations that lead to a document sharing system data breach that exposed 498 records, and a data breach involving the theft of a flash drive containing unencrypted data of 595 patients. HIPAA requires nurses and other health care professionals to report any violations they witness, even if they recognize it was accidental. 1. Covered Entity: Private Practices Initially, the pharmacy chain refused to acknowledge that the log books contained protected health information. Dr. Glazer did not cooperate with OCR during the investigation, resulting in OCR imposing a civil monetary penalty of $100,000 for the HIPAA Right of Access violation. Pharmacy Chain Institutes New Safeguards for PHI in Pseudoephedrine Log Books A Nurse's Guide to the Use of Social Media discusses the case of a hospice nurse whose cancer patient had posted about her depression. A violation of HIPAA attributable to ignorance can attract a fine of $100 $50,000. Employees also were trained to review registration information for patient contact directives regarding leaving messages. OCR determined there had been a failure to protect patient information which resulted in an impermissible disclosure of 2,150 patient records.