A healthcare provider delivering pain management services in Florida and other states faces a $1.19 million civil monetary penalty from the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR). The OCR investigation stems from a data breach, but not the type of breach we are used to seeing in the news – it was not a ransomware attack, business email compromise, or some other type of attack by an unknown hacker. Similar to many other OCR enforcement actions, however, a lack of basic safeguards under the Security Rule drove the penalty.

According to the OCR:

• On May 3, 2018, the covered entity retained an independent contractor to provide business consulting services.
• The contractor’s services ceased in August of 2018.
• On February 20, 2019, the covered entity discovered that on three occasions, between September 7, 2018, and February 3, 2019, the contractor impermissibly accessed the provider’s electronic medical record (EMR) system and accessed the electronic protected health information (ePHI) of approximately 34,310 individuals. The contractor used that information to generate approximately 6,500 false Medicare claims.
• On February 21, 2019, the covered entity terminated the independent contractor’s access to its systems, and in early April of that same year filed a breach report with OCR. The report described that the compromised PHI included names, addresses, phone numbers, email addresses, dates of birth, Social Security numbers, chart numbers, insurance information, and primary care information.

Evidently, the contractor continued to have access to the covered entity’s information systems for 6 months following the point at which services ended, according to the OCR.

“Current and former workforce can present threats to health care privacy and security—risking continuity of care and trust in our health care system,” said OCR Director Melanie Fontes Rainer. “Effective cybersecurity and compliance with the HIPAA Security Rule means being proactive in reviewing who has access to health information and responding quickly to suspected security incidents.” 

The OCR commenced an investigation and reported findings that the covered entity:

• did not conduct a thorough and accurate risk analysis prior to the breach incident, or until September 30, 2022, more than three years after the incident,
• had not implemented policies and procedures to regularly review records of information system activity containing ePHI,
• did not implement termination procedures designed to remove access to ePHI for workforce members who had separated, and
• did not implement policies and procedures addressing access to workstations.

It is worth noting that the $1.19 million penalty comes after a reduction for “Recognized Security Practices.” Recall that following an amendment enacted in 2022, the HITECH Act now requires the OCR to take into account Recognized Security Practices in connection with certain enforcement and audit activities under the HIPAA Security Rule. In short, if a covered entity can demonstrate Recognized Security Practices as being in place continuously for the 12 months prior to a security incident, a reduction in the amount of civil monetary may be warranted.

In this case, OCR provided the covered entity an opportunity to adequately demonstrate that it had RSPs in place. The covered entity did and OCR applied a reduction to the penalty.

Regulated entities, including healthcare providers, often cite to “controls” they have in place, believing they are sufficient to address their compliance obligations. This application of the rule for Recognized Security Practices is a good example of why that is not the case. That is, while it is important to maintain good controls, those efforts still need to be measured against the applicable compliance requirements, such as set forth under the HIPAA Security Rule.