Skip to content Skip to navigation

Illinois Healthcare Network to Pay $475,000 for Lack of Timely Breach Notification

January 10, 2017
by Heather Landi
| Reprints

The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) announced this week the first Health Insurance Portability and Accountability Act (HIPAA) enforcement action based on the untimely reporting of a breach of unsecured protected health information (PHI).

Chicago-based Presence Health Network, a healthcare system in Illinois consisting of more than 150 locations, has agreed to settle potential violations of the HIPAA Breach Notification Rule by paying $475,000 and implementing a corrective action plan, according to a HHS OCR press release. Presence Health’s system includes 11 hospitals and 27 long-term care and senior living facilities. Presence also has multiple physicians’ offices and health care centers in its system and offers home care, hospice care, and behavioral health services.

HSS OCR officials stated in the press release, “With this settlement amount, OCR balanced the need to emphasize the importance of timely breach reporting with the desire not to disincentive breach reporting altogether.”

According to HHS, on January 31, 2014, OCR received a breach notification report from Presence indicating that on October 22, 2013, Presence discovered that paper-based operating room schedules, which contained the PHI of 836 individuals, were missing from the Presence Surgery Center at the Presence St. Joseph Medical Center in Joliet, Illinois. The information consisted of the affected individuals’ names, dates of birth, medical record numbers, dates of procedures, types of procedures, surgeon names, and types of anesthesia. 

“OCR’s investigation revealed that Presence Health failed to notify, without unreasonable delay and within 60 days of discovering the breach, each of the 836 individuals affected by the breach, prominent media outlets (as required for breaches affecting 500 or more individuals), and OCR,” the agency stated.

“Covered entities need to have a clear policy and procedures in place to respond to the Breach Notification Rule’s timeliness requirements” OCR Director Jocelyn Samuels said in a prepared statement. “Individuals need prompt notice of a breach of their unsecured PHI so they can take action that could help mitigate any potential harm caused by the breach.”

The HIPAA Breach Notification Rule, 45 CFR §§ 164.400-414, requires HIPAA covered entities and their business associates to provide notification following a breach of unsecured protected health information. Similar breach notification provisions implemented and enforced by the Federal Trade Commission (FTC), apply to vendors of personal health records and their third party service providers, pursuant to section 13407 of the HITECH Act.

According to HHS, covered entities must notify affected individuals following the discovery of a breach of unsecured protected health information. These individual notifications must be provided without unreasonable delay and in no case later than 60 days following the discovery of a breach and must include, to the extent possible, a brief description of the breach, a description of the types of information that were involved in the breach, the steps affected individuals should take to protect themselves from potential harm, a brief description of what the covered entity is doing to investigate the breach, mitigate the harm, and prevent further breaches, as well as contact information for the covered entity (or business associate, as applicable).

More information about OCR’s guidance on breach notification can be found here.

 

 

 

Get the latest information on Cybersecurity and attend other valuable sessions at this two-day Summit providing healthcare leaders with educational content, insightful debate and dialogue on the future of healthcare and technology.

Learn More

Topics

News

Lenovo Health and Orbita Launch Voice-Enabled Home Health Assistant Technology

North Carolina-based health IT company Lenovo Health and Orbita, a Boston-based connected home healthcare company, launched a virtual home care solution and showcased the technology at HIMSS17 in Orlando.

Phase 2 Winners Chosen in ‘Move Health Data Forward’ Challenge

The Office of the National Coordinator for Health Information Technology has announced five winners in Phase 2 of the “Move Health Data Forward” Challenge, a contest to develop solutions to help with the flow of health information.

National Association for Trusted Exchange Unveils FHIR-Based Solution for Data Sharing

At the HIMSS17 conference in Orlando on Monday, The National Association for Trusted Exchange (NATE) unveiled NATE’s Blue Button Directory (NBBD) and is demonstrating it as part of the Federal Health Architecture’s demonstrations in the HIMSS17 Interoperability Showcase.

Health Catalyst Incorporates Regenstrief’s NLP Solution in Its Analytics Platform

At the HIMSS17 conference in Orlando, the nonprofit Regenstrief Institute announced a partnership with analytics vendor Health Catalyst involving Regenstrief's artificial intelligence-powered text analytics technology.

Survey: Cybersecurity Getting More Attention at the C-Suite and Board Level

Cybersecurity has been elevated to a central concern for healthcare providers, with more attention at the board level and the C-suite, according to a new survey by Orem, Utah-based KLAS Research and the College of Healthcare Information Management Executives (CHIME). The study found that 42 percent of organizations have a vice president or C-level official in charge of cybersecurity and for 39 percent of organizations, the head of cybersecurity is at the director level.

Partnership for Health IT Patient Safety Focuses on Patient Identification

The Partnership for Health IT Patient Safety has rolled out its second set of Safe Practice Recommendations with a focus on reducing patient misidentification.