Montefiore Medical Center Settles HIPAA Breach for $4.75 Million

Rivkin Radler LLP
Contact

Rivkin Radler LLP

On February 6, the U.S. Department of Health and Human Services (HHS) announced a $4.75 million settlement with Montefiore Medical Center (MMC) for a breach of unsecured electronic protected health information (ePHI). The settlement stems from an internal investigation that found that an employee of the New York hospital system sold patient information to an identity theft ring, including patients’ names, addresses, Social Security numbers, and health insurance information.

In May 2015, MMC discovered that the employee had improperly accessed over 12,000 patients’ information through the hospital’s electronic medical record system in early 2013. In response, MMC filed a breach report with HHS in November 2015.

As part of the settlement, MMC entered into a corrective action plan (CAP) requiring it to conduct a thorough assessment of the potential security risks to the confidentiality and integrity of the hospital’s ePHI. The risk assessment must include all of MMC’s locations and facilities and evaluate the risks to the security of ePHI in electronic equipment, data systems, and programs and applications used by MMC that contain, store, transmit, and receive ePHI.

Under the CAP, MMC is also required to develop a written risk management plan that sufficiently addresses any security risks identified by the risk assessment, and review and revise its privacy and security rules policies and procedures based on the risk assessment’s findings. If HHS determines that MMC is in breach of the CAP during its two-year term, HHS may impose a civil monetary penalty.

Healthcare providers’ compliance obligations under HIPAA’s Privacy and Security Rules include conducting periodic risk assessments of their data infrastructure in order to identify any risks and vulnerabilities.

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations. Attorney Advertising.

© Rivkin Radler LLP

Written by:

Rivkin Radler LLP
Contact
more
less

PUBLISH YOUR CONTENT ON JD SUPRA NOW

  • Increased visibility
  • Actionable analytics
  • Ongoing guidance

Rivkin Radler LLP on:

Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
- hide
- hide