The Office of Civil Rights entered into a settlement with a small non-profit provider because the provider could not produce a written business associate agreement with a vendor using protected health information.  The settlement requires the children's GI center to pay a $31,000 in addition to costly corrective actions.  There are two (2) lessons here:  (1) all providers should ensure business associate agreements are in place with vendors using PHI and (2) contract management systems are vital.  If you have any concerns about your organization's compliance with the HIPAA Privacy or Security Rule, please contact us.  

The settlement can be found here.  

Memorial Healthcare System, a 6 hospital non-profit system in South Florida, agreed to pay the Department of Health and Human Services $5.5 million to settle potential HIPAA Privacy & Security Rules. 

The settlement followed a HHS investigation finding that: (i) MHS disclosed the Protected Health Information of 80,000 individuals in violation of the Privacy Rule and (ii) MHS failed to implement security procedures as required by the Security Rule.  

This settlement is another reminder of the importance of health care providers and institutions implementing the administrative, physical and technical safeguards of the HIPAA Security Rule.  

Walters Law congratulates attorney Adam Walters on the publication of his article "Caught in the Crosshairs: Physician Liability for Prescription Opioid Abuse" in the American Health Lawyers Association Physician Organization's February Newsletter.  For a copy of the article, please email adamwaltersatty@gmail.com