OCR imposes a $2.15 million civil penalty against Jackson Health System for alleged HIPAA violations

The Office for Civil Rights at the U.S. Department of Health and Human Services has imposed a civil monetary penalty of $2.15 million against Florida-based Jackson Health System for alleged violations of the Health Insurance Portability and Accountability Act of 1996 Security and Breach Notification Rules between 2013 and 2016.

JHS is a nonprofit academic medical system based in Miami, Florida, which operates six major hospitals, a network of urgent care centers, multiple primary care and specialty care centers, long-term care nursing facilities, and corrections health services clinics.

The system provides health services to roughly 650,000 patients annually, and employs about 12,000 people.

WHAT'S THE IMPACT

On August 22, 2013, JHS submitted a breach report to OCR stating that its Health Information Management Department had lost paper records containing the protected health information of 756 patients in January of that year. The health system's internal investigation determined that an additional three boxes of patient records were also lost in December 2012. Yet JHS did not report the additional loss -- or the increased number of people affected to 1,436 -- until June 7, 2016.

In July 2015, OCR initiated an investigation following a media report that disclosed the PHI of a JHS patient. A reporter had shared a photograph of a JHS operating room screen containing the patient's medical information on social media. The system then determined that two employees had accessed this patient's electronic health record without a job-related purpose.

On February 19, 2016, JHS submitted a breach report to OCR reporting that an employee had been selling patient PHI. The employee had inappropriately accessed more than 24,000 patients' records since 2011.

OCR's investigation revealed that JHS failed to provide timely and accurate breach notification to the Secretary of HHS, conduct enterprise-wide risk analyses, manage identified risks to a reasonable and appropriate level, regularly review information system activity records, and restrict authorization of its workforce members' access to patient ePHI to the minimum necessary to accomplish their job duties.

JHS waived its right to a hearing and did not contest the findings in OCR's Notice of Proposed Determination. OCR then issued a Notice of Final Determination; JHS has paid the full civil money penalty.

THE LARGER TREND

In late 2018, it was announced that JHS would be one of the inaugural participants in Humana's new hospital incentive program. Participants are compensated based on their quality improvement and performance in the areas of patient experience, patient safety and patient outcomes.

ON THE RECORD

"OCR's investigation revealed a HIPAA compliance program that had been in disarray for a number of years," said OCR Director Roger Severino. "This hospital system's compliance program failed to detect and stop an employee who stole and sold thousands of patient records; lost patient files without notifying OCR as required by law; and failed to properly secure PHI that was leaked to the media."

Twitter: @JELagasse

Email the writer: jeff.lagasse@himssmedia.com