July 7, 2020

Volume X, Number 189

July 07, 2020

Subscribe to Latest Legal News and Analysis

July 06, 2020

Subscribe to Latest Legal News and Analysis

$3 Million Settlement for Two Separate HIPAA Breaches Affecting Over 62,500 Individuals

Cottage Health and the Office for Civil Rights at the U.S. Department of Health and Human Services (HHS-OCR) recently entered into a $3 million no-fault settlement and three-year corrective action plan to settle potential violations of the Health Insurance Portability and Accountability Act (HIPAA). This was HHS-OCR’s last HIPAA related settlement of 2018 – a record year in HIPAA enforcement activity, as detailed in this DBR on Data blog post.

HHS-OCR received notifications from Cottage Health on December 2, 2013, and December 1, 2015, regarding breaches of unsecured electronic protected health information (ePHI) affecting approximately 50,917 individuals and 11,608 individuals, respectively. According to the resolution agreement, the December 2013 breach resulted from a contractor removing the electronic security protections from one of Cottage Health’s servers, which made ePHI fully internet accessible and available for download without a username and password.  The December 2015 breach arose from an employee activating the wrong website on a database management system server in response to an IT troubleshooting ticket, which also resulted in ePHI becoming fully accessible on the internet.

HHS-OCR alleged that Cottage Health failed to do the following:

  • Conduct an accurate and thorough analysis of the potential risks and vulnerabilities to its ePHI as required by HIPAA.

  • Implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level to comply with HIPAA.

  • Perform a technical evaluation in response to its contractor installing software.

  • Obtain satisfactory assurances in the form of a business associate agreement that the contractor would appropriately safeguard ePHI that the contractor maintained on behalf of Cottage Health.

In addition to the significant settlement figure, Cottage Health will undergo a robust corrective action plan, which includes an enterprise-wide risk analysis, implementing a risk management plan, evaluating environmental and operational changes, and developing and distributing policies and procedures that address HIPAA Privacy and Security Rules.

© 2020 Faegre Drinker Biddle & Reath LLP. All Rights Reserved.National Law Review, Volume IX, Number 45


About this Author

Sumaya Noush, Drinker Biddle Law Firm, HealthCare Attorney

Sumaya Noush counsels health care clients on strategic and operational matters including transactions, corporate governance, and regulatory compliance. She helps her clients navigate the daily challenges of running their operations while identifying opportunities for growth in today’s rapidly evolving and highly competitive health care market.

Sumaya previously served as a law clerk for Drinker Biddle, an instructor at Yale’s Bioethics Institute where she taught a seminar on FDA law and medical ethics, and a Visiting Scholar at...