$2.5 Million Settlement Reached As HIPAA Crackdown Continues On Unsecured Portable Devices

In Short

The Situation: The U.S. Department of Health and Human Services has announced a $2.5 million settlement relating to a health care provider's alleged HIPAA violations in connection with an employee's stolen laptop.

The Implication: The settlement indicates that the federal government will continue aggressive enforcement actions against providers failing to comply with HIPAA when using digital media and portable devices.

Looking Ahead: Digital health vendors and their health care providers should review their current policies regarding portable devices and run regular risk analyses to ensure compliance.

A recent settlement of $2.5 million for alleged violations of the Health Insurance Portability and Accountability Act ("HIPAA") continues a trend of government enforcement targeting health care providers and vendors that fail to comply with HIPAA when using digital media and devices. The settlement should be seen as a warning for digital health companies in particular to review their policies and procedures regarding HIPAA security compliance for mobile applications, devices, and platforms.

Background

On April 24, 2017, the U.S. Department of Health and Human Services, Office of Civil Rights ("OCR") announced a $2.5 million settlement for alleged HIPAA violations in connection with a laptop stolen from a parked vehicle outside an employee's home. The settlement was reached with CardioNet, Inc., a provider of remote mobile monitoring services, following CardioNet's disclosure of multiple breaches in 2012 of unsecured electronic protected health information ("ePHI") affecting more than 1,300 and 2,200 people, respectively, both of which appear to involve stolen laptops.

OCR's Findings

While initiating an investigation in response to CardioNet's disclosure of the breaches, OCR discovered more systemic violations of HIPAA's security rules. The settlement agreement alleges that CardioNet had failed to: (i) implement processes to prevent, detect, contain, and correct security violations; (ii) implement policies and procedures governing the receipt and removal of hardware and electronic media containing ePHI into and out of its facilities, the encryption of such media, and the movement of these items within its facilities until years after initially reporting the breaches; and (iii) safeguard against impermissible disclosures of PHI by its employees or take sufficient steps to immediately correct the disclosure. OCR's announcement...