Catholic Health Care Services of the Archdiocese of Philadelphia (CHCS) is the first business associate to be held directly liable for violations under the HIPAA rules. CHCS provided management and information technology services to six nursing homes. According to the OCR Resolution Agreement, OCR received separate notifications from each of the six nursing homes
Medical Corporation Not Liable For Employee’s Disclosure Of Confidential Medical Information
In March 2013, the Second Circuit certified to the New York Court of Appeals the issue of whether a medical corporation may be liable for the unauthorized disclosure of medical information, when the employee responsible for the breach was not a physician and was acting outside the scope of her employment (see post).
Photocopiers and HIPAA – Health Plan Settles with HHS for $1.2 Million
Is your office photocopy machine a HIPAA time-bomb? Affinity Health Plan recently learned that the answer is yes, to the tune of a $1.2 million settlement with the US Department of Health and Human Services Office for Civil Rights (OCR). Affinity is a not-for-profit managed care organization which includes one of the New York metropolitan
Feds to Offer Free HIPAA Compliance Webinars
The Office for Civil Rights of the US Department of Health and Human Services, in conjunction with the Workgroup for Electronic Data Interchange (“WEDI”), has announced a series of four free webinars on compliance with the latest Omnibus HIPAA/HITECH final rule, which implements significant changes in the requirements imposed upon health care organizations, providers, and
Health Privacy Liability Issue Proceeds to NY Court of Appeals
In last week’s decision in Doe v. Guthrie Clinic, Ltd., the Second Circuit Court of Appeals certified to the New York Court of Appeals the issue of whether a medical corporation may be liable for the unauthorized disclosure of medical information, when the employee responsible for the breach was not a physician and was
New Breach Notification Requirements Released
The US Department of Health and Human Services (“HHS”) Office for Civil Rights (“OCR”) released final rules on January 17, 2013 governing the privacy and security of protected health information under HIPAA and the HITECH Act. The new rules take effect March 26, 2013; compliance is expected by September 23, 2013. This post will focus
First HHS Settlement for Small HIPAA Breach
On January 2, 2013, the US Department of Health and Human Services announced a $50,000 settlement with Hospice of North Idaho for a data breach involving the theft of a lost, unencrypted laptop computer containing the health information of 441 patients.
This settlement is the first for a reported breach affecting fewer than 500 individuals.
Electronic Health Records Come Under OIG Scrutiny
The Health Information Technology for Economic and Clinical Health Act (the “HITECH”) Act of 2009 aims to have all hospitals and physicians use electronic health records (“EHRs”) for all persons in the United States by 2014. Federal and State financial incentives, electronic billing requirements, and the need for ever-increasing collaboration and sharing of information among
Feds Release HIPAA Audit Protocol
The US Department of Health and Human Services Office of Civil Rights (“OCR”) recently released its HIPAA audit protocol. Audits of HIPAA compliance were mandated by the 2009 Health Information Technology for Economic and Clinical Health (“HITECH”) Act, which amended many parts of HIPAA and included breach notification requirements.
The OCR conducted a number of