Commentary Addressing Risks and Opportunities Through the Lifecycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

The Department of Health and Human Services Office for Civil Rights (HHS OCR) today announced its <a href="http://www.hhs.gov/ocr/privacy/hipaa/enforcement/examples/affinity_agreement.pdf">4th resolution agreement of 2013</a>.&nbsp; Affinity Health Plan, Inc., a not-for-profit managed care plan serving the New York metropolitan area, has agreed to settle potential violations of the HIPAA Privacy and Security Rules for $1,215,780.&nbsp; The resolution agreement relates to Affinity&rsquo;s April 15, 2010 report to OCR of an incident where Affinity was contacted by a representative of CBS Evening News, regarding an investigatory report, that CBS had purchased a photocopier previously leased by Affinity, which contained confidential medical information on the hard drive for approximately 344,579 individuals.&nbsp;
On May 19, 2010, in response to Affinity&rsquo;s report, OCR initiated its investigation into Affinity&rsquo;s compliance with the Privacy, Security, and Breach Notification Rules.&nbsp; OCR&rsquo;s investigation indicated the following:
<ul>
<li>Affinity impermissibly disclosed ePHI when it failed to properly erase photocopier hard drives prior to sending the photocopiers to a leasing company;</li>
<li>Affinity failed to assess and identify the security risks and vulnerabilities of ePHI stored in the photocopier hard drives; and </li>
<li>Affinity failed to implements its policies for the disposal of ePHI with respect to the photocopier hard drives.&nbsp; </li>
</ul>
In addition to the settlement amount, Affinity agreed to a 120-day corrective action plan which includes:&nbsp;
<ul>
<li>Affinity using best efforts to retrieve all photocopier hard drives that were contained in photocopiers previously leased by Affinity that remain in the possession of the leasing agent, and safeguarding all ePHI contained therein from impermissible disclosure.&nbsp; Affinity must either provide documentation of best efforts or provide written certification that it has completed this requirement.&nbsp; </li>
<li>Affinity conducting a comprehensive risk analysis of the ePHI security risks and vulnerabilities, which includes all electronic equipment and systems controlled, owned, or leased by Affinity.&nbsp; This risk analysis must be provided to OCR for review and recommended changes before implementation and training of Affinity staff.&nbsp; </li>
</ul>
Directly addressed in HHS&rsquo; press release regarding the Affinity settlement, HHS advises covered entities to be cognizant of the importance of safeguarding sensitive data, referring to <a href="http://business.ftc.gov/documents/bus43-copier-data-security">FTC guidance</a>, <a href="http://csrc.nist.gov/publications/drafts/800-88-rev1/sp800_88_r1_draft.pdf">NIST guidance</a>, and <a href="http://www.medscape.org/sites/advances/patients-rights">OCR training</a>.&nbsp; Sensitive data can be stored on devices beyond just laptops, thumb drives, and external hard drives. &nbsp;As part of your periodic risk anlaysis, consider what other devices or equipment may be storing ePHI that have not been previously considered. &nbsp;With enforcement of the Final Rule beginning on September 23, 2013, as previously discussed on the <a href="https://www.dataprivacymonitor.com/hipaahitech/what-covered-entities-and-business-associates-need-to-do-to-prepare-for-the-new-hipaahitech-requirem-1/">Data Privacy Monitor</a>, liability for potential HIPAA violations such as the above will also extend directly to business associates that receive or store PHI.&nbsp;

Health Plan Settles HHS OCR Investigation Related to Photocopier Breach for $1.2m