August 10, 2020

Volume X, Number 223

August 10, 2020

Subscribe to Latest Legal News and Analysis

2012 Breach and Lacking Compliance Program Results in $750,000 Settlement for Radiation Oncology Group

On September 2, 2015, the U. S. Department of Health and Human Services (“HHS”) announced a $750,000 settlement with Cancer Care Group, P.C. (“CCG”), a radiation oncology practice in Indiana, for Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy and Security Rules violations. The alleged violations occurred in 2012, but a subsequent HHS Office for Civil Rights (OCR) investigation led to allegations from OCR that there was a lack of compliance with HIPAA Privacy and Security Rules requirements dating back to 2005.

CCG notified OCR on August 29, 2012 of a data breach of electronic protected health information (ePHI) resulting from the theft of a laptop bag that was left unattended in an employee’s car.  The bag contained a laptop computer and unencrypted backup storage media.  OCR estimated that the stolen data included the names, addresses, dates of birth, Social Security numbers, insurance information, and clinical information of approximately 55,000 current and former patients.

After receiving notification of the breach, OCR conducted an investigation that OCR alleged revealed CCG was in “widespread non-compliance with the HIPAA security rule.”  Specifically, OCR determined that CCG failed to conduct an enterprise-wide risk analysis at any time between April 21, 2005 (the compliance date of the Security Rule) and November 5, 2012, almost 5 months after the data breach.  OCR also determined that CCG also failed to have in place a written policy covering the removal of hardware and electronic media containing ePHI from CCG facilities.  OCR noted that an enterprise-wide risk analysis would have determined that removal of unencrypted media was a high risk to the group’s ePHI security.

In addition to the $750,000 payment, the settlement requires CCG to adopt a robust corrective action plan to correct HIPAA compliance program deficiencies. The entire Resolution Agreement can be viewed here.

This case highlights the need for all covered entities and business associates to conduct regular risk assessments and vulnerability testing.  A proper risk assessment will help organizations to identify vulnerabilities to the ePHI they store. While the Security Rule does not mandate encryption, as it is an addressable implementation specification, this settlement again reinforces OCR’s position that unencrypted computer hard drives, mobile devices, and electronic media will be under intense scrutiny should a breach occur. Thus, in most instances it is advisable for those types of devices to be encrypted.

©2020 Epstein Becker & Green, P.C. All rights reserved.National Law Review, Volume V, Number 254

TRENDING LEGAL ANALYSIS


About this Author

Arthur J. Fried, Health Care, Life Sciences, Attorney, Epstein Becker, Law firm
Member

ARTHUR J. FRIED is a Member of the Firm in the Health Care and Life Sciences practice, in the firm's New York office. He represents all types of health care providers, including academic medical centers, hospitals, and faculty practices.

Mr. Fried:

  • Advises hospitals, academic medical centers, and other providers in such areas as strategic health system development, physician integration, health care reform, medical staff matters, and governance

  • Provides advice on...

212-351-4710
Patricia M. Wagner, Epstein becker green, health care, life sciences
Member

PATRICIA M. WAGNER is a Member of the Firm in the Health Care and Life Sciences and Litigation practices, in the firm's Washington, DC, office. In 2014, Ms. Wagner was selected to the Washington DC Super Lawyers list in the area of Health Care.

Ms. Wagner's experience includes the following:

Advising clients on a variety of matters related to federal and state antitrust issues 

Representing clients in antitrust matters in front of the Federal Trade Commission and the United States Department of Justice, and state antitrust authorities 

Advising clients on issues related HIPAA Privacy and security

Advising clients on issues related to state licensure and regulatory requirements

202-861-4182
Jonathan K. Hoerner, Epstein Becker law firm Life Sciences Attorney Washington D.C.,
Associate

JONATHAN K. HOERNER is an Associate in the Health Care and Life Sciences practice, in the Washington, DC, office of Epstein Becker Green.

Mr. Hoerner:

  • Defends health care and life sciences companies in litigation as well as in connection with federal and state government investigations, qui tam actions, and internal investigations related to health care fraud
  • Advises clients regarding fraud and abuse issues arising under anti-kickback laws, the Stark Law, and the False Claims Act
  • Assists clients in evaluating, developing,...
202-861-1826