Home Health & Hospice Week

Small breaches, charitable status won’t save you from big penalties.

Pay close attention to a case the HHS Office for Civil Rights cited in announcing its crackdown on small breaches, or risk the same fate.

Back in June, OCR announced a $650,000 settlement with Catholic Health Care Services of the Archdioceses of Philadelphia (CHCS) to settle potential HIPAA violations including a breach.

Background: At the time of the incident, CHCS provided management and IT services as a Business Associate to six skilled nursing facilities. In April 2014, OCR launched an investigation after receiving notification that CHCS had a breach involving the theft of a CHCS-issued employee iPhone.

The iPhone contained hundreds of SNF residents’ PHI, including Social Security numbers, diagnoses and treatment information, medical procedures, names of family members and legal guardians, and other medical information. The iPhone was not encrypted nor password protected.

OCR’s investigation revealed that, at the time of the breach incident, CHCS had no policies addressing the removal of mobile devices containing PHI from its facility, nor what to do in the event of a security incident. CHCS also had no risk analysis and risk management plan, OCR claims.

Other lessons to learn from the case include:

• “This settlement agreement sets an important milestone as OCR’s first resolution agreement with a BA,” notes attorney Rick Hindmand of Chicago-based McDonald Hopkins. Expect more BA scrutiny in the pipeline.
• The settlement plus a two-year Corrective Action Plan and the $650,000 settlement is significant, given that the breach involved only 412 records. Don’t expect small breaches to carry small penalties.
• A charitable structure and mission also won’t save you. CHCS was slapped with the hefty penalty despite its non-profit status and religious affiliation, and despite providing “much-needed services” in the Philadelphia region to the elderly, developmentally disabled individuals, young adults aging out of foster care, and individuals living with HIV/AIDS, notes Colin Zick, an attorney with Foley Hoag.