Hospital Security Breach Leads to $240,000 HIPAA Settlement: How Healthcare Providers Can Avoid Similar Fines

A recent incident involving Yakima Valley Memorial Hospital in Washington has resulted in a $240,000 settlement under the Health Insurance Portability and Accountability Act of 1996 (HIPAA).

The U.S. Department of Health and Human Services’ Office for Civil Rights (OCR) conducted an investigation following a breach notification report received in May 2018. The report revealed that 23 security guards in Yakima Valley Memorial Hospital’s emergency department had inappropriately accessed patient medical records of 419 individuals without a legitimate reason using their login credentials. The accessed information included sensitive details such as names, dates of birth, medical record numbers, addresses, treatment notes, and insurance information.

OCR Director Melanie Fontes Rainer commented; “Data breaches caused by current and former workforce members impermissibly accessing patient records are a recurring issue across the healthcare industry. Health care organizations must ensure that workforce members can only access the patient information needed to do their jobs. HIPAA covered entities must have robust policies and procedures in place to ensure patient health information is protected from identify theft and fraud.”

Yakima Valley Memorial Hospital settled the case by agreeing to pay a fine of $240,000. Additionally, the hospital committed to implementing an action plan to update policies and procedures, ensuring the safeguarding of protected health information and preventing unauthorized access by their workforce. The Hospital will also be monitored for two years by OCR to ensure compliance with the HIPAA Security Rule.

How your practice can prevent a similar incident

Healthcare providers can learn from this case and take proactive steps to protect patient information. Here are some key measures to avoid breaches and potential fines:

1. Conduct Comprehensive Risk Analysis: Perform a thorough assessment to identify vulnerabilities and risks to electronic protected health information (ePHI). This analysis helps identify areas that require increased security measures.
2. Develop and Implement a Risk Management Plan: Based on the risk analysis, establish a plan to address and mitigate the identified security risks and vulnerabilities. This plan should outline specific actions to enhance data protection.
3. Maintain Updated HIPAA Policies and Procedures: Regularly review and revise HIPAA policies and procedures to align with current industry standards. Ensure that employees are trained on these policies and understand their responsibilities in protecting patient information.
4. Enhance Workforce Training: Implement an ongoing training program that educates all employees about HIPAA requirements, privacy regulations, and the consequences of unauthorized data access. Training should emphasize the importance of maintaining patient confidentiality.
5. Review Vendor Relationships: Evaluate relationships with vendors and third-party service providers to determine if they qualify as business associates. Obtain and maintain business associate agreements to ensure they are also compliant with HIPAA regulations.

The Yakima Valley Memorial Hospital case highlights the importance of safeguarding patient information in compliance with HIPAA regulations. To avoid costly fines and reputational damage, healthcare providers should conduct risk analyses, develop risk management plans, maintain updated policies and procedures, provide comprehensive staff training, and carefully manage relationships with vendors. By prioritizing data security and privacy, healthcare organizations can mitigate the risk of breaches and protect the sensitive information entrusted to them.

Here is a link to the original press release from hhs.gov on 06/05/2023: https://www.hhs.gov/about/news/2023/06/15/snooping-medical-records-by-hospital-security-guards-leads-240-000-hipaa-settlement.html

If you would like to see the resolution agreement and corrective action plan, you can find it here: https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/yakima-ra-cap/index.html

---

---