Medicare Compliance & Reimbursement

The HHS Office for Civil Rights (OCR) closed out 2015 with a booming December for healthcare breaches, logging 23 reported breach incidents.

Of the 23 total, most involved healthcare providers (19) with four affecting health plans. Twelve breaches involved unauthorized access/disclosure, followed by theft (7), hacking/IT incidents (3), and one incident of improper disposal. OCR posted these reported breach incidents on its so-called “Wall of Shame” (https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf), which displays HIPAA breaches affecting 500 or more individuals.

Most also involved paper/films, accounting for nine of the total breaches, plus an additional breach that involved both paper/films and a desktop computer. Five breaches arose from laptops or other portable electronic devices, while four involved email, three network servers, and one electronic medical record (EMR).

St. Luke’s Cornwall Hospital in New York State reported the largest breach in December 2015 with 29,156 affected individuals, arising from the theft of a portable electronic device. Most other breaches reported during the month were much smaller in scope, affecting far fewer individuals.

Beware: There’s no mistake that 2015 was a “banner year” for healthcare breaches, according to a Dec. 31 analysis by Jan McDavid, Esq., Chief Compliance Officer and General Counsel for HealthPort. HHS data indicates that more than 102 million Americans’ health records were inappropriately accessed or misused last year. Also, eight of the 10 largest healthcare provider hacks of all time occurred in 2015, with the largest from an insurer whose hacking-related breach affected 78.8 million individuals.

Look ahead: In 2016, some estimates place costs for healthcare breaches at hundreds of billions of dollars, McDavid warned. “HIPAA and related laws have real ‘teeth’ now. Be prepared.”