Header graphic for print
Technology Law Source Mapping the evolving legal landscape

Category Archives: HIPAA Compliance

Subscribe to HIPAA Compliance RSS Feed

Hospital pays six figures to settle data breach enforcement suit

Posted in Data Breach, HIPAA Compliance, Privacy

At the end of last month, Boston hospital Beth Israel Deaconess Medical Center (BIDMC) settled a data breach lawsuit brought by the Massachusetts Attorney General related to the 2012 theft of a physician’s laptop. Under a consent decree entered on Nov. 20, 2014, BIDMC agreed to pay $100,000 and to take a number of steps to ensure future compliance with state and federal data security laws.

The state of Massachusetts filed the enforcement suit against BIDMC on the same day as the consent decree’s entry, alleging that an unauthorized person gained access to a BIDMC physician’s unlocked office on campus in May 2012 and stole an unencrypted personal laptop sitting unattended on a desk. Though the laptop was not hospital-issued, the physician used it regularly for hospital-related business with BIDMC’s knowledge and authorization. The physician and his staff allegedly were not following hospital policy and applicable law requiring employees to encrypt and physically secure laptops containing protected health information and personal information. According to the state, the laptop contained nearly 4,000 patients’ and employees’ protected health information and nearly 200 employees’ personal information, including names, Social Security numbers and medical information. The complaint also alleged that BIDMC failed to notify patients about the data breach until nearly three months later, in August 2012.…


Continue Reading →

Porter Wright announces 2014 Technology Seminar Series

Posted in Data Breach, Domain Names, gTLDs, HIPAA Compliance, HITECH Act Compliance, Information Technology, Intellectual Property, Porter Wright News, Privacy

Porter Wright continues its tradition of providing cutting-edge information about how technology affects your business with the 2014 Technology Seminar Series, beginning June 18. This year’s sessions are:

Social media in litigation: a shield and a sword

June 18

The worlds of social media and litigation have collided. Social media evidence is used in employment discrimination lawsuits, in divorce and custody cases, in criminal cases – and intellectual property cases are won and lost based on the information disclosed on social media sites. Like it or not, social media is an aspect of litigation that is here to stay. Sara Jodka, Colleen Marshall and Jay Yurkiw will walk you through how social media affects the way companies prepare for and engage in litigation, including the good, the bad and the ugly. This session will provide guidance about how you can make sure that your company’s social media use will not get the company into hot water. Presenters also will share helpful insights regarding what to do about social media when litigation is filed and identify the biggest social media in litigation hazards.…


Continue Reading →

LabMD joins Wyndham in challenging FTC’s data privacy authority

Posted in HIPAA Compliance, HITECH Act Compliance, Information Technology, Privacy

Section 5 of the Federal Trade Commission Act — the Act that established the FTC in the first place — makes it unlawful to engage in “unfair methods of competition … and unfair or deceptive acts or practices…” Though the words seem simple enough, its application in today’s world is anything but simple, particularly when you talk about data privacy. Two companies — Wyndham Worldwide Corp. and LabMD Inc. — are publicly, and independently, challenging the FTC’s authority over their data security policies (and subsequent lapses). This post is a quick update about LabMD’s challenge.

In August 2013, the FTC filed an administrative complaint against LabMD, alleging that it lacked appropriate data security and unreasonably exposed the health and personal data of its consumers. LabMD conducts clinical laboratory tests on patients and reports its finding to patients’ health care providers. In performing the needed tests, LabMD typically obtains personal information, including names, addresses, dates of birth, SSNs, bank account or credit card information, laboratory tests, test codes and results, diagnoses, clinical histories, and health insurance company names and policy numbers. LabMD possesses such data for approximately 1 million consumers.

The FTC charged that LabMD “failed to provide reasonable and appropriate security for personal information on its computer networks.” Among other things, the complaint states that LabMD failed to:…


Continue Reading →

HHS imposes 7 Figure Fine for Breach of HIPAA; Soon to be the Norm?

Posted in HIPAA Compliance, HITECH Act Compliance

In case you missed the OCR announcement late yesterday afternoon, the Department of Health and Human Services announced that it was imposing a civil money penalty of $4.3 million dollars against Cignet Health for various violations of HIPAA.   These penalties were based upon the violation categories and increased penalty amounts authorized by the HITECH Act; discussed further here.  The violations stemmed in part from Cignet’s failure to provide 41 patients access to their own medical records as required under 45 C.F.R. § 164.524.   In addition to the huge amount of the fine, according the HHS, this action marks the first civil money penalty issued by HHS for HIPAA Privacy Rule violations.  This action could indicate a renewed push by HHS to enforce violations of HIPAA and utilize its heightened penalty schedule and enhanced enforcement powers provided under the HITECH Act.  Could this be the new norm for HIPAA enforcement?  Only time will tell.…


Continue Reading →

HHS Withdrawing Breach Notification Final Rule – Temporarily

Posted in Data Breach, HIPAA Compliance, Privacy

The Department of Health and Human Services (HHS) announced yesterday that it was temporarily withdrawing the breach notification final rule from review of the Office of Management and Budget (OMB) to allow HHS further time to consider these regulations.  The breach notification rule, among other things, requires covered entities to notify individuals whose protected health information (as defined by HIPAA) has been compromised or breached. HHS’s explanation for the withdrawal was that breach notification was "a complex issue and the Administration is committed to ensuring that individuals’ health information is secured to the extent possible to avoid unauthorized uses and disclosures, and that individuals are appropriately notified when incidents do occur."  HHS stated that it intends to publish a final rule in the coming months.

 …


Continue Reading →

HHS Requests Information on TPO Accounting of Disclosures

Posted in HIPAA Compliance, HITECH Act Compliance

The Office of Civil Rights for the Department of Health and Human Services (HHS) recently requested comments related to its upcoming rulemaking under the Health Information Technology for Economic and Clinical Health (HITECH) Act, part of the American Recovery and Reinvestment Act of 2009. HITECH expands the current HIPAA Privacy Rule requirement that a covered entity provide individuals with a right to receive an accounting of certain disclosures of the individual’s protected health information to certain parties. Currently, under HIPAA, a covered entity is not obligated to provide an accounting of disclosures if such disclosures were in furtherance of treatment, payment, or health care operations (TPO).  HITECH eliminated these exemptions by requiring covered entities to account for TPO disclosures if such disclosures are made through an electronic health record.…


Continue Reading →