HIPAA violations underscore the need for device encryption
HIM-HIPAA Insider, April 28, 2014
Want to receive articles like this one in your inbox? Subscribe to HIM-HIPAA Insider!
HHS released a statement stressing the need for encryption, citing two recent OCR settlement agreements that totaled nearly $2 million as examples of the dangers posed by unencrypted devices in healthcare. Unencrypted computers and mobile devices pose a significant security risk for organizations because patient PHI is incredibly vulnerable in the event that one of these devices in stolen or hacked.
The OCR’s $1,725,220 resolution agreement with Concentra Health Services, a national healthcare company, for potential HIPAA violations stemming from the theft of an unencrypted laptop highlights the importance of encryption.
An OCR investigation revealed that during several risk analyses Concentra identified that its lack of encryption was a security threat. Although the organization took steps to encrypt its devices, its efforts were inconsistent and incomplete. Concentra failed to implement sufficient policies and procedures to detect and correct security violations by failing to execute appropriate risk management measures to reduce the lack of encryption, according to the resolution agreement.
Similarly, OCR agreed to a $250,000 monetary settlement with Arkansas-based QCA Health Plan, Inc., following an incident involving the theft of an unencrypted laptop containing PHI from a workforce member’s car. The health plan began its effort to encrypt its devices following the breach, but failed to comply with a multitude of HIPAA Privacy and Security Rule requirements from April 2005 to June 2012, according to the HHS statement. Much like Concentra, QCA Health Plan also failed to implement policies and procedures to prevent, detect, contain, and correct security violations, including conducting a thorough risk assessment, according to the resolution agreement.
Encryption is the best defense for covered entities and business associates, Susan McAndrew, OCR’s deputy director of health information privacy, said in the statement.
Want to receive articles like this one in your inbox? Subscribe to HIM-HIPAA Insider!
Related Products
-
Briefings on Accreditation and Quality
Briefings on Accreditation and Quality will help you with all of your accreditation and survey preparation needs. Every...
-
The CMS Survey Coordinator's Handbook
There is no reason to struggle with CMS requirements. HCPro has teamed up with former contracted CMS surveyor Jeff Coleman...
-
Medicare Audits in Long-Term Care: A Guide to MACs, RACs, and ZPICs
This book describes the different types of Medicare audits that nursing homes face and helps you take a proactive approach...
-
Long-Term Care Skilled Services: Applying Medicare's Rules to Clinical Practice
Take the mystery out of skilled services and know when to skill a resident based on government regulations, Medicare...
-
The Long-Term Care State Operations Manual
Updated to reflect changes under the MDS 3.0, CAAs, and CMS Forms 672, 802, and 805, The Long-Term Care State Operations...
Most Popular
- Articles
-
- Don't forget the three checks in medication administration
- Note similarities and differences between HCPCS, CPT® codes
- Practice the six rights of medication administration
- Q&A: Primary, principal, and secondary diagnoses
- The consequences of an incomplete medical record
- Coronavirus: 7 Infection Prevention Best Practices for Healthcare Settings
- OB services: Coding inside and outside of the package
- Skills of effective case managers
- Complications from immobility by body system
- ICD-10-CM coma, stroke codes require more specific documentation
- E-mailed
-
- Medicare fraud strike charges 243 healthcare providers for more than $700 million in false billing
- Q/A: Billing for DME
- Intake and output monitoring
- Hospitalists branch into perioperative medicine with preop assessments
- Hospital Billing from A to Z: 3- and 1-day rules
- HIPAA Training Handbooks pick-a-pack!
- HCPro, Inc. Launches New HIPAA Products for Clinical Researchers
- Follow 72-hour and 24-hour rules
- Ensuring clear and concise documentation critical for case managers
- Coding Clinic reiterates guidelines for provider documentation
- Searched
