Stolen unlocked laptop leads to HIPAA penalty of $850000 for Lahey Hospital and Medical Center

Lahey Hospital and Medical Center Lahey, a non profit teaching hospital affiliated with Tufts Medical School, providing primary and specialty care in Burlington, Massachusetts lately noticed the theft of one laptop, kept on the stand of portable scanner, from one of the unlocked treatment room during the night of August 11, 2011 and informed Office for Civil Rights (OCR). This laptop was used to operate the scanner and produce images for viewing through the hospital’s Radiology Information System and Picture Archiving and Communication System.  The laptop’s hard drive contained the protected health information (PHI) of 599 individuals. This was in fact a violations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy and Security Rules with the U.S. Department of Health and Human Services (HHS). Further investigation by OCR specified widespread non-compliance with the HIPAA rules, such as:

1. Failure to conduct a thorough risk analysis of all of its ePHI;
2. Failure to physically safeguard a workstation that accessed ePHI;
3. Failure to implement and maintain policies and procedures regarding  safeguarding of ePHI maintained on workstations utilized in connection with diagnostic/laboratory equipment;
4. Lack of a unique user name for identifying and tracking user identity with respect to the workstation at issue in this incident;
5. Failure to implement procedures that recorded and examined activity in the workstation at issue in this incident; and
6. Impermissible disclosure of 599 individuals’ PHI.

Lahey Hospital agreed to pay fine of $850,000 and also agreed to settle potential violations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy and Security Rules with the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR).  Hospital will adopt a vigorous corrective action plan to mend deficiencies in its HIPAA compliance program.

Over and above this settlement of $850,000, Lahey must review and address its history of noncompliance with the HIPAA Rules by providing OCR with a comprehensive, enterprise-wide risk analysis and corresponding risk management plan, as well as reporting certain events and providing evidence of compliance.

The Resolution Agreement and Corrective Action Plan can be found here 

HHS offers tips on how to protect and secure health information when using mobile devices:  https://www.healthit.gov/providers-professionals/your-mobile-device-and-health-information-privacy-and-security