L.A. Care agrees to pays $1.3 million to settle potential HIPAA violations

Photo: Alexsandar Nakic/Getty Images

L.A. Care has agreed to pay $1.3 million to settle two investigations by the Department of Health and Human Services' Office for Civil Rights over potential violations of the Health Insurance Portability and Accountability Act (HIPAA).

L.A. Care is a large publicly operated health plan that provides benefits and coverage through state, federal and commercial programs. 

OCR said its investigation found evidence of potential noncompliance with the HIPAA Privacy and Security Rules across LA Care's organization, a serious concern given the size of the covered entity. The health plan serves close to three million members.

WHY THIS MATTERS

The settlement concludes two OCR investigations initiated from a large breach report and a media article regarding a separate security incident. 

The potential violations in this case included:

• Failure to conduct an accurate and thorough risk analysis to determine risks and vulnerabilities to ePHI across the organization.
• Failure to implement security measures sufficient to reduce risks and vulnerabilities to ePHI to a reasonable and appropriate level.
• Failure to implement sufficient procedures to regularly review records of information system activity.
• Failure to perform a periodic technical and nontechnical evaluation in response to environmental or operational changes affecting the security of ePHI.
• Failure to implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use ePHI.

In addition to the monetary settlement, under the agreement LA Care will implement a corrective action plan to protect the security of electronic protected health information (ePHI). 

The corrective action plan will be monitored for three years and requires LA Care to: 

• Conduct an accurate and thorough risk analysis to determine risks and vulnerabilities to electronic patient/system data across the organization.
• Develop and implement a risk management plan to address identified risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI.
• Develop, implement, and distribute policies and procedures for a risk analysis and risk management plan.
• Report to HHS when it conducts an evaluation due to an environmental and operational change that affects the security of ePHI in LA Care's possession or control.
• Report to HHS within 30 days when workforce members fail to comply with the HIPAA Rules.

THE LARGER TREND

OCR has settled a number of alleged HIPAA violations.

In August, OCR announced a settlement with UnitedHealthcare over a potential violation of the HIPAA Privacy Rule's right of access provision that   requires that patients be able to access their medical information in a timely manner. UnitedHealth has agreed to implement a corrective action plan and pay $80,000 to resolve the investigation.

In May, OCR settled with MedEvolve for $350,000 over potential HIPAA violations regarding a data breach in which a server containing protected health information was left unsecure and accessible over the internet.

ON THE RECORD

"Breaches of protected health information by a HIPAA-regulated entity often reveal systemic, noncompliance with the HIPAA Rules," said OCR Director Melanie Fontes Rainer. "HIPAA-regulated entities need to be proactive in ensuring their compliance with the HIPAA Rules, and not wait for OCR to reveal long-standing HIPAA deficiencies. Entities such as LA Care must protect the health information of its insureds while providing health care for the most vulnerable residents of Los Angeles County through its coverage, which includes Medicaid, Medicare, and Affordable Care Act health plans."

Twitter: @SusanJMorse
Email the writer: SMorse@himss.org