Skip to content Skip to navigation

UMass Will Pay $650,000 to Settle Potential HIPAA Violations

November 22, 2016
by Heather Landi
| Reprints

The University of Massachusetts Amherst (UMass) has agreed to settle potential violations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy and Security Rules stemming from a malware infection back in 2013.

The settlement includes a corrective action plan and a monetary payment of $650,000, which is reflective of the fact that the University operated at a financial loss in 2015, according to a press release from the U.S. Department of Health and Human Services, Office for Civil Rights (OCR).

On June 18, 2013, UMass reported to the OCR that a workstation in its Center for Language, Speech, and Hearing was infected with a malware program, which resulted in the impermissible disclosure of electronic protected health information (ePHI) of 1,670 individuals, including names, addresses, social security numbers, dates of birth, health insurance information, diagnoses and procedure codes. The university determined that the malware was a generic remote access Trojan that infiltrated their system, providing impermissible access to ePHI, because UMass did not have a firewall in place, according to the OCR press release.

OCR’s investigation indicated the following potential violations of the HIPAA Rules:

UMass had failed to designate all of its health care components when hybridizing, incorrectly determining that while its University Health Services was a covered health care component, other components, including the Center for Language, Speech, and Hearing where the breach of ePHI occurred, were not covered components.  Because UMass failed to designate the Center a health care component, UMass did not implement policies and procedures at the Center to ensure compliance with the HIPAA Privacy and Security Rules. Specifically, OCR notes that the HIPAA Privacy Rule permits legal entities that have some functions that are covered by HIPAA and some that are not to elect to become a “hybrid entity.”  “To successfully ‘hybridize,’ the entity must designate in writing the health care components that perform functions covered by HIPAA and assure HIPAA compliance for its covered health care components,” OCR stated.

According to OCR’s investigation, UMass failed to implement technical security measures at the Center to guard against unauthorized access to ePHI transmitted over an electronic communications network by ensuring that firewalls were in place at the Center. 

Finally, UMass did not conduct an accurate and thorough risk analysis until September 2015. 

“HIPAA’s security requirements are an important tool for protecting both patient data and business operations against threats such as malware,” OCR Director Jocelyn Samuels said in a statement. “Entities that elect hybrid status must properly designate their health care components and ensure that those components are in compliance with HIPAA’s privacy and security requirements.”  

In addition to the monetary settlement, UMass has agreed to a corrective action plan that requires the organization to conduct an enterprise-wide risk analysis; develop and implement a risk management plan; revise its policies and procedures, and train its staff on these policies and procedures.

 

Topics

News

Lenovo Health and Orbita Launch Voice-Enabled Home Health Assistant Technology

North Carolina-based health IT company Lenovo Health and Orbita, a Boston-based connected home healthcare company, launched a virtual home care solution and showcased the technology at HIMSS17 in Orlando.

Phase 2 Winners Chosen in ‘Move Health Data Forward’ Challenge

The Office of the National Coordinator for Health Information Technology has announced five winners in Phase 2 of the “Move Health Data Forward” Challenge, a contest to develop solutions to help with the flow of health information.

National Association for Trusted Exchange Unveils FHIR-Based Solution for Data Sharing

At the HIMSS17 conference in Orlando on Monday, The National Association for Trusted Exchange (NATE) unveiled NATE’s Blue Button Directory (NBBD) and is demonstrating it as part of the Federal Health Architecture’s demonstrations in the HIMSS17 Interoperability Showcase.

Health Catalyst Incorporates Regenstrief’s NLP Solution in Its Analytics Platform

At the HIMSS17 conference in Orlando, the nonprofit Regenstrief Institute announced a partnership with analytics vendor Health Catalyst involving Regenstrief's artificial intelligence-powered text analytics technology.

Survey: Cybersecurity Getting More Attention at the C-Suite and Board Level

Cybersecurity has been elevated to a central concern for healthcare providers, with more attention at the board level and the C-suite, according to a new survey by Orem, Utah-based KLAS Research and the College of Healthcare Information Management Executives (CHIME). The study found that 42 percent of organizations have a vice president or C-level official in charge of cybersecurity and for 39 percent of organizations, the head of cybersecurity is at the director level.

Partnership for Health IT Patient Safety Focuses on Patient Identification

The Partnership for Health IT Patient Safety has rolled out its second set of Safe Practice Recommendations with a focus on reducing patient misidentification.