Health Information Compliance Alert

Tip: Investigate BAs’ HIPAA track records.

Many vendors target the healthcare market with promises that their products are HIPAA-compliant. Unfortunately, you cannot buy HIPAA compliance — and these claims won’t stop the feds from investigating if your organization has a violation or data breach.

Background: In December, the Federal Trade Commission (FTC) announced a settlement with SkyMed International, Inc., a Scottsdale, Arizona-based firm that sells travel and medical emergency services, for exposing consumers’ personal information in a data security breach. After a 2019 complaint, the FTC discovered that SkyMed failed to protect individuals’ data, including health information, when an unsecured cloud database exposed 130,000 membership records on the internet. In addition, the FTC found that the organization didn’t properly assess its risks “by performing penetration testing and other measures, and failed to monitor its network for unauthorized access,” an FTC release says.

Though SkyMed alerted current and former customers that their payment and health information wasn’t compromised in the breach, the firm didn’t actually review the data nor look into unauthorized access of the database materials, the FTC asserts. “Instead, after confirming that the data was online and publicly accessible, SkyMed deleted the database,” the release says.

Here’s the Case Clincher

But, on top of risk analysis fails, a data breach, and botched investigation of said incident, SkyMed also duped consumers into believing that its services were HIPAA compliant.

“SkyMed deceived consumers by displaying for nearly five years a ‘HIPAA Compliance’ seal on every page of its website, which gave the impression that its privacy policies had been reviewed and met” HIPAA security and privacy requirements, the FTC alleges.

Many third-party firms say that their products or tools are “HIPAA compliant,” but the Department of Health and Human Services (HHS) and its auxiliary agencies don’t certify or endorse vendors’ products as HIPAA compliant.

Reminder: “HHS does not endorse or otherwise recognize private organizations’ ‘certifications’ regarding the Security Rule, and such certifications do not absolve covered entities of their legal obligations under the Security Rule. Moreover, performance of a ‘certification’ by an external organization does not preclude HHS from subsequently finding a security violation,” HHS Office for Civil Rights (OCR) guidance says.