On May 10, 2017, the Office of Civil Rights (OCR) announced a $2.4M settlement with Memorial Hermann Health System, a not-for-profit health system located in Southeast Texas, which is comprised of 16 hospitals and specialty services in the Greater Houston area. The violation was the release of the name of a patient in a press release and a failure to discipline those workforce members who had included the patient’s name in the release. The patient had been the victim of an apparent identity theft, and a false ID was presented to hospital staff. While the hospital’s report of the alleged fraud to the police was permissible, the unauthorized use of the patient’s name in the press release was not.

In addition to the $2.4M settlement amount, Memorial Hermann and the OCR have entered into a corrective action plan. The plan calls for updating policies and procedures, additional training, and an attestation of understanding from Memorial Hermann of the rules concerning permissible use and disclosure of protected health information, including disclosures to the media.