Commentary Addressing Risks and Opportunities Through the Lifecycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

<img class="alignright wp-image-4326 size-medium" src="http://dataprivacymonitor.bakerhostetlerblogs.com/wp-content/uploads/sites/5/2015/11/health-iStock_000063719731_Full-206x300.jpg" alt="" width="206" height="300" />

On the heels of the <a href="https://www.dataprivacymonitor.com/hipaahitech/ocr-continues-waving-its-hipaa-enforcement-flag-dont-forget-about-medical-devices/">Lahey Hospital and Medical Center resolution agreement</a>, OCR announced a <a href="http://www.hhs.gov/ocr/privacy/hipaa/enforcement/examples/TRIPLES/triple-s-ocr-resolution-agreement.pdf">resolution agreement with Triple-S Management Corporation</a> and its subsidiaries, Triple-S Salud Inc. and Triple-C Inc. (collectively “Triple-S”). As part of the announcement, Office for Civil Rights (OCR) Director Jocelyn Samuels flagged two specific areas for covered entities to focus their Health Insurance Portability and Accountability Act (HIPAA) compliance efforts: business associate agreements and minimum necessary use of protected health information (PHI).

The subsidiaries are covered entities or business associates as defined by HIPAA. OCR initiated its investigation of these entities following several separate reported breaches. In its resolution agreement, OCR identified the entities’ violations of HIPAA with the following conduct:
<ol>
	<li>Impermissibly disclosing the PHI of beneficiaries as a result of breach incidents;</li>
	<li>Failing to implement appropriate administrative, physical, and technical safeguards to protect the privacy of its beneficiaries’ PHI;</li>
	<li>Impermissibly disclosing its beneficiaries’ PHI to an outside vendor with which it did not have an appropriate business associate agreement;</li>
	<li>Disclosing more PHI than was necessary to accomplish the purpose for which it hired the outside vendor;</li>
	<li>Failing to conduct an accurate and thorough risk analysis that incorporates all IT equipment, applications, and data systems utilizing ePHI;</li>
	<li>Failing to implement security measures sufficient to reduce the risks and vulnerabilities to its ePHI to a reasonable and appropriate level; and</li>
	<li>Failing to implement procedures for terminating access to ePHI when the employment of a workforce member ends.</li>
</ol>
OCR reached a $3.5 million settlement amount with Triple-S and issued an extensive three-year corrective action plan (CAP). The CAP requires Triple-S to conduct a security risk analysis and implement a risk management plan, implement a process for evaluating environmental and operational changes, review and revise policies and procedures, and provide training to its workforce and business associates. The CAP also requires annual reports attesting to compliance with the CAP.

This resolution agreement and CAP continue to demonstrate OCR’s focus on security risk analyses and risk management plans. OCR has previously set forth <a href="https://www.healthit.gov/providers-professionals/security-risk-assessment">guidance</a> for covered entities and business associates on conducting risk analyses. As covered entities and business associates prepare their 2016 budgets and work plans, we recommend review and revision of these important items for HIPAA compliance.

Another Day, Another OCR Resolution Agreement – Numerous Repeated Breaches Lead to $3.5 Million Settlement