Skip to content Skip to navigation

Stolen Thumb Drive Costs Dermatology Practice $150K

December 31, 2013
by Rajiv Leventhal
| Reprints

A stolen unencrypted thumb drive containing the electronic protected health information (ePHI) of approximately 2,200 individuals has cost a dermatology practice $150,000 following a settlement with the Department of Health and Human Services (HHS).

The Concord, Mass.-based Adult & Pediatric Dermatology (APDerm), which delivers dermatology services in four locations in Massachusetts and two in New Hampshire, will also be required to implement a corrective action plan to correct deficiencies in its HIPAA (Health Insurance Portability and Accountability Act) compliance program.

According to HHS, this case marks the first settlement with a covered entity for not having policies and procedures in place to address the breach notification provisions of the Health Information Technology for Economic and Clinical Health (HITECH) Act, passed as part of American Recovery and Reinvestment Act of 2009 (ARRA).

The investigation of APDerm opened by the HHS Office for Civil Rights (OCR) found that the unencrypted thumb drive was stolen was stolen from a vehicle of one its staff members. The thumb drive was never recovered.

The investigation revealed that the practice had not conducted an accurate and thorough analysis of the potential risks and vulnerabilities to the confidentiality of ePHI as part of its security management process.  Further, APDerm did not fully comply with requirements of the HITECH Breach Notification Rule to have in place written policies and procedures and train workforce members.

“As we say in healthcare, an ounce of prevention is worth a pound of cure,” OCR director Leon Rodriguez said in a statement. “That is what a good risk management process is all about—identifying and mitigating the risk before a bad thing happens.  Covered entities of all sizes need to give priority to securing electronic protected health information.”

In addition to a $150,000 resolution amount, the settlement includes a corrective action plan requiring APDerm to develop a risk analysis and risk management plan to address and mitigate any security risks and vulnerabilities, as well as to provide an implementation report to OCR.



OSU Wexner Medical Center Receives AHIMA Grace Award

The Ohio State University Wexner Medical Center (OSUWMC) received the American Health Information Management Association (AHIMA) annual Grace Award in recognition of its leadership in health information management.

Kansas Health Information Network Expands its Network across State Lines

The Kansas Health Information Network (KHIN) has announced that it is expanding its horizons, and is now connected to Health Information Exchange Texas (HIETexas).

CMS Selects Vendor to Modernize Critical Identity Infrastructure

The Centers for Medicare & Medicaid Services (CMS) last week announced it had selected San Francisco-based vendor Okta to enhance the security of its information systems.

Mayo Clinic, ASU Partner for Medical Education, Healthcare Innovation

The Mayo Clinic and Arizona State University have announced a partnership centered on transforming medical education and healthcare in the U.S. through a variety of innovation efforts.

CMS Hospital Compare Website Updated with VA Data

The Centers for Medicare & Medicaid Services (CMS) has announced the inclusion of Veterans Administration (VA) hospital performance data as part of the federal agency’s Hospital Compare website.

CMS Awards Funding to Special Innovation Projects

The Centers for Medicare & Medicaid Services (CMS) has awarded 20, two-year Special Innovation Projects (SIPs) aimed at local efforts to deliver better care at lower cost.