HIPAA penalty of $4.8 Million, largest till date is paid by New York and Presbyterian Hospital and Columbia University

New York and Presbyterian Hospital (NYP) and Columbia University (CU) have agreed to settle charges by The U.S. Department of Health and Human
Services (HHS) Office for Civil Rights (OCR) that they potentially violated the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy and Security Rules by failing to secure thousands of patients’ electronic protected health information (ePHI) held on their network. The monetary payments of $4,800,000 include the largest HIPAA settlement to date.

NYP and CU had filled a joint breach report, dated September 27, 2010, regarding the disclosure of the ePHI of 6,800 individuals, including patient status, vital signs, medications, and laboratory results.

Christina Heide, acting deputy director of health information privacy for OCR, emphasized that: “When entities participate in joint compliance arrangements, they share the burden of addressing the risks to protected health information. Our cases against NYP and CU should remind health care organizations of the need to make data security central to how they manage their information systems.”

The investigation revealed that the breach was caused when a physician employed by CU who developed applications for both NYP and CU attempted to deactivate a personally-owned computer server on the network containing NYP patient ePHI. Because of a lack of technical safeguards, deactivation of the server resulted in ePHI being accessible on internet search engines. The entities learned of the breach after receiving a complaint by an individual who found the ePHI of the individual’s deceased partner, a former patient of NYP, on the internet.

In addition to the impermissible disclosure of ePHI on the Internet, OCR alleged:

Neither NYP nor CU made efforts prior to the breach to assure that the server was secure and that it contained appropriate software protections.
Neither NYP nor CU had conducted an accurate and thorough risk analysis that incorporated all IT equipment, applications, and data systems utilizing ePHI.
Neither NYP nor CU had developed an adequate risk management plan that addressed the potential threats and hazards to the security of ePHI.
NYP failed to implement appropriate policies and procedures for authorizing access to its databases and failed to comply with its own policies on information access management.

NYP paid the lion’s share of the settlement amount-$3.3 million, with CU agreeing to pay $1.5 million-totaling $4.8 million. Additionally, both entities agreed to a substantive three-year corrective action plan, which includes undertaking a risk analysis, developing a risk management plan, revising policies and procedures, training staff, and providing progress reports.

It is recommended for compliance team members to go through the Certified HIPAA Privacy Security expert (CHPSE) training to ensure the core compliance team has the same level of knowledge and rest of the staff can go through other level of training as fit to their job role. For more details visit HIPAA Training site