Lahey Hospital pays $850,000 over security breach, potential HIPAA violations
Settlement tied to a 2011 incident where a laptop containing patient info was stolen from the hospital.
Image via Wikipedia.
Lahey Hospital and Medical Center has settled with the U.S. Department of Health and Human Services' Office for Civil Rights for potential HIPAA violations related to lax security.
The nonprofit teaching hospital, which is affiliated with Tufts Medical School, will pay $850,000 and "will adopt a robust corrective action plan to correct deficiencies" in its HIPAA policies, according to HHS.
The settlement has its roots in an incident four years ago, when Lahey notified OCR of a stolen laptop taken from an unlocked room there in August 2011.
[Also: Sutter Health says data on 2,500 patients involved in potential breach]
The laptop, which operated the scanner and produced images for viewing through Lahey's RIS/PACS system, was on a stand that accompanied a portable CT scanner. Its hard drive contained the protected health information of 599 patients.
The subsequent investigation by OCR uncovered "widespread non-compliance with the HIPAA rules" at Lahey, according to HHS.
These included failures to conduct a thorough risk analysis of its electronic protected health information; physically safeguard a workstation that accessed patient data and maintain policies related to data security on workstations use in connection with diagnostic and lab equipment, the OCR report shows.
Like Healthcare Finance on Facebook
In addition, it cited Lahey for lack of a unique username to identify and track user identity with respect to the workstation at issue in this incident; failure to implement procedures that recorded and examined activity in the workstation at issue in this incident and impermissible disclosure of 599 individuals' PHI.
"It is essential that covered entities apply appropriate protections to workstations associated with medical devices such as diagnostic or laboratory equipment," said OCR Director Jocelyn Samuels, in a press statement. "Because these workstations often contain ePHI and are highly portable, such ePHI must be considered during an entity's risk analysis and entities must ensure necessary safeguards that conform to HIPAA's standards are in place."
Twitter: @mikemiliardHITN
