St. Joseph's Health to pay $2.1 million over HIPAA violations after patient data potentially made public
Server install caused patient information to be accessible over the internet through search engines.
California-based St. Joseph's Health will pay $2.1 million to settle allegations over potential HIPAA violations stemming from faulty implementation of a server for meaningful use participation, the Department of Health and Human Services announced Tuesday.
On February 14, 2012, SJH reported to the HHS Office for Civil Rights that from February 1, 2011, until February 13, 2012, files it created for meaningful use program participation containing electronic protected health information had been publicly accessible on the internet through Google and possibly other search engines.
According to HHS, the server SJH purchased to store the files included a file sharing application whose default settings allowed anyone with an internet connection to access them. SJH did not examine or modify the server or the application when they were implemented, and the public had unrestricted access to information on 31,800 individuals that included patient names, health statuses, diagnoses and demographic information.
OCR's investigation unveiled specific potential violations including: potentially disclosure of the PHI of 31,800 individuals; failure to conduct an evaluation in response to environmental and operational changes stemming from implementation of the new server for meaningful use participation; inadequate assessment of the risks and vulnerabilities to the "confidentiality, integrity and availability of ePHI" in that the assessment should have resulted in an enterprise-wide risk analysis, as required by the HIPAA Security Rule, but it did not, HHS said.
In addition to the fine, the system will enter into a corrective action plan requiring them to conduct a system-wide risk analysis, put into operation a risk management plan, revise its policies and procedures and train staff on the revised measures.
SJH's network includes 14 acute care hospitals, home health agencies, hospice care, outpatient services, skilled nursing facilities, community clinics and physician organizations throughout California, and in parts of Texas and New Mexico.
Twitter: @BethJSanborn
