Data Breach, Education, HIPAA / HITECH Enforcement, News Events, OCR HIPAA Audits, Settlements

Recent Enforcement Actions

Recent Enforcement ActionsData Breach Four examples

Just when we thought our information was up to date!

On Tuesday February 13, 2018, the HHS Office for Civil Rights announced that “Consequences for HIPAA violations don’t stop when a business closes”.  Filefax, Inc. located in Northbrook, Illinois is no longer in business after an anonymous complaint that Protected Health Information (PHI)  destined for the shredding/recycling facility was left unattended in an unlocked truck (alleged date February 6 & 9, 2015). OCR’s investigation reported that Filefax, Inc. impermissibly disclosed the PHI of 2,150 individuals at the Filefax parking lot by granting an unauthorized person to remove the PHI from Filefax and leaving it unsecured outside their facility.Filefax Inc

During the 2016 court ruling in an unrelated litigation, a receiver was appointed to liquidate Filefax’s assets for distribution to creditors, etc. The receiver agreed to pay $100,000 monetary settlement and to store/dispose of the remaining medical records discovered at the Filefax’s facility in accordance to HIPAA’s standards.

View the Press Release 

Cyber Security, Data Breach, HIPAA / HITECH Enforcement, OCR HIPAA Audits, Risk Analysis/Risk Management, Settlements

Largest Settlement Agreement to Date Assessed by the OCR

The Office for Civil Rights (OCR) has assessed the largest settlement amount to date against Advocate Health Care Network . The OCR fined Advocate $ 5.55 Million for multiple potential violations of the HIPAA Security Rule.

The investigations that eventually led to the fine were initiated in 2013 after three successive self-reported data breaches by Advocate. Two of the three were related to a Business Associate of Advocate. OCR stated, “This significant settlement, the largest to-date against a single entity, is a result of the extent and duration of the alleged noncompliance (dating back to the inception of the Security Rule in some instances), the involvement of the State Attorney General in a corresponding investigation, and the large number of individuals whose information was affected by Advocate, one of the largest health systems in the country.”

The press release and a link to the settlement agreement can be found here. Note that the link to the source document, the settlement agreement itself, stopped functioning a few hours after the press release went out. Please see: 

This settlement reinforces the importance of including all of an organization’s PHI in its risk analysis process, and a review and inclusion of all Business Associates and Business Associate Agreements.