We use cookies to give you the best online experience. By using our website you agree to our use of cookies in accordance with our cookie policy. Learn more here.Close Me
The recent Office for Civil Rights (OCR) enforcement
action against Alaska's Medicaid program provides insight into
OCR's enforcement approach and timely reminders for covered
entities hoping to avoid a similar fate. In the first
settlement of its kind against a state Medicaid agency, Alaska has
agreed to pay the U.S. Department of Health and Human Services
(HHS) $1,700,000 under a Resolution Agreement to settle alleged
violations of the Health Insurance Portability and Accountability
Act of 1996 (HIPAA) Security Rule. The settlement stems from
an investigation by OCR following a breach report by DHSS as
required under the Health Information Technology for Economic and
Clinical Health (HITECH) Act.
The breach report, submitted by DHSS in 2009, disclosed that a
USB hard drive, which may have contained electronic protected
health information (ePHI) of Alaska Medicaid beneficiaries, was
stolen from a DHSS employee's car. The resulting OCR
investigation uncovered evidence of inadequate DHHS policies and
procedures to safeguard ePHI. OCR found that DHHS
failed to complete a risk analysis, implement adequate risk
management measures, conduct employee security training, implement
device and media controls, and address device and media
encryption.
What may HIPAA covered entities learn from the Alaska
settlement?
Seven-figure settlements are becoming more the rule than the
exception when OCR finds serious violations.
OCR continues to require corrective action plans, which add
significantly to a covered entity's costs resulting from a
violation. The Alaska corrective action plan requires DHSS to
properly safeguard the ePHI of its Medicaid beneficiaries, and to
designate an independent monitor to regularly report to OCR on the
state's efforts to ensure compliance.
OCR is not afraid to go after a state agency. In a press release, OCR Director Leon Rodriguez
stated: "This is OCR's first HIPAA enforcement action
against a state agency and we expect organizations to comply with
their obligations under these rules regardless of whether they are
private or public entities."
The settlement also illustrates the priority that OCR is
placing on enforcement of HIPAA violations involving stolen
devices. Mr. Rodriguez noted that "[c]overed entities
must perform a full and comprehensive risk assessment and have in
place meaningful access controls to safeguard hardware and portable
devices."
The content of this article is intended to provide a general
guide to the subject matter. Specialist advice should be sought
about your specific circumstances.
To print this article, all you need is to be registered on Mondaq.com.
Click to Login as an existing user or Register so you can print this article.
Whether you are an employer that provides health insurance for your employees, a business in the growing healthcare industry, a hospital, or other medical provider—or you provide services to any of those entities—you need to know about changes to the privacy and security rules under the Health Insurance Portability and Accountability Act of 1996 (HIPAA).
Understanding the complexities of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy and Security Rules is often a challenge for health care providers and consumers.
Marilyn Tavenner received bipartisan support from members of the Senate Committee on Finance in her confirmation hearing to lead the Centers for Medicare and Medicaid Services (CMS) though a full Senate vote is being held up, the president released his FY 2014 budget proposal with health care reform and specified reimbursement reductions to providers and manufacturers totaling $400 billion over 10 years sprinkled throughout it, and Department of Health and Human Services (HHS) Secretary Sebelius
The Office of Inspector General for the Department of Health and Human Services has recently issued an updated Special Advisory Bulletin on the Effect of Exclusion from Participation in Federal Health Care Programs.
On Tuesday, the North Carolina legislature has enacted into law, pending the governor's signature, a prohibition on the use of most favored nations clauses in contracts between commercial health insurers and providers.
