Eli's Hospice Insider

Published on Fri Mar 01, 2013 PDF

Make sure you’re taking steps to protect patient information as required under HIPAA, or you may pay the price.

For example: The Hospice of North Idaho will pay $50,000 to the U.S. Department of Health and Human Services for a "breach of unprotected electronic protected health information affecting fewer than 500 individuals," according to an HHS press release.

"This action sends a strong message to the health care industry that, regardless of size, covered entities must take action and will be held accountable for safeguarding their patients’ health information," says HHS Office for Civil Rights Director Leon Rodriguez in the release.

The action comes following an investigation by the OCR after HONI reported the theft of an unencrypted laptop, in June 2011, containing the electronic protected health information of 441 patients. The organization regularly uses laptops containing ePHI for field work.

"Over the course of the investigation, OCR discovered that HONI had not conducted a risk analysis to safeguard ePHI. Further, HONI did not have in place policies or procedures to address mobile device security as required by the HIPAA Security Rule," the press release adds.