Home Health & Hospice Week

If you’re unsure whether you should spend the time, resources, and effort encrypting your agency’s mobile devices, just look at a recent HIPAA settlement for the answer.

The University of Rochester Medical Center in Rochester, New York, filed HIPAA breaches in 2013 and 2017 with the HHS Office for Civil Rights after an unencrypted flash drive and an unencrypted laptop, respectively, were stolen, leading to protected health information (PHI) being “impermissibly” disclosed.

OCR investigated and found that URMC “failed to conduct an enterprise-wide risk analysis; implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level; utilize device and media controls; and employ a mechanism to encrypt and decrypt electronic protected health information (ePHI) when it was reasonable and appropriate to do so,” according to an OCR press release.

OCR notes that it investigated URMC in 2010 as well, after a different unencrypted flash drive was lost and that URMC self-identified lack of encryption as a “high risk to ePHI” — but the organi­zation continued to allow the use of unencrypted mobile devices anyway.

URMC agreed to pay $3 million in fines and take “substantial corrective action” in regard to potential violations of the HIPAA Privacy and Security Rules.

“Because theft and loss are constant threats, failing to encrypt mobile devices needlessly puts patient health information at risk,” OCR director Roger Severino says in the release. “When covered entities are warned of their deficiencies, but fail to fix the problem, they will be held fully responsible for their neglect.”