Alaska Medicaid Pays $1.7 Million for Data Breach | Healthcare Informatics Magazine | Health IT | Information Technology Skip to content Skip to navigation

Alaska Medicaid Pays $1.7 Million for Data Breach

June 27, 2012
by Gabriel Perna
| Reprints

The Alaska Department of Health and Social Services (DHSS) and the state Medicaid agency, has agreed to pay the U.S. Department of Health and Human Services’ (HHS) $1,700,000 to settle alleged violations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Security Rule.  Additionally, Alaska’s DHSS agreed to take corrective action to properly safeguard the electronic protected health information (ePHI) of their Medicaid beneficiaries. 

The breach according to the Alaska DHSS was a stealing of a portable electronic storage device (USB hard drive) possibly containing ePHI from the vehicle of a DHSS employee.  Over the course of the investigation, OCR found evidence that DHSS did not have adequate policies and procedures in place to safeguard ePHI. The investigation initially began when the HHS Office for Civil Rights (OCR) after a breach report was submitted by Alaska DHSS as required by the Health Information Technology for Economic and Clinical Health (HITECH) Act. 

The evidence indicated that DHSS had not completed a risk analysis, implemented sufficient risk management measures, completed security training for its workforce members, implemented device and media controls, or addressed device and media encryption as required by the HIPAA Security Rule.

 “Covered entities must perform a full and comprehensive risk assessment and have in place meaningful access controls to safeguard hardware and portable devices,” OCR director Leon Rodriguez said in a statement.  “This is OCR’s first HIPAA enforcement action against a state agency and we expect organizations to comply with their obligations under these rules regardless of whether they are private or public entities.”

OCR enforces the HIPAA Privacy and Security Rules. The Privacy Rule gives individuals rights over their protected health information and sets rules and limits on who can look at and receive that health information. The Security Rule aims to protect health information in electronic form by requiring entities covered by HIPAA to use physical, technical, and administrative safeguards to ensure that electronic protected health information remains private and secure.

Topics

Comments

There have been so many incidents of healthcare data breaches that this might be the “proverbial straw” making readers conclude breaches are inevitable. Readers might then repond by a strong compulsion to contract with one of the many Breach Response Services.

However, why not be proactive by taking the one action that eliminates the possibility of breach response and breach penalities, radically reduces the risk of a breach, and provides the strongest leagally defendable safeguards?

Qualifying for the HHS Safe Harbor from Breach Resporting provides all of the above and is explain on page 13 in the current issue on Privacy Insurance in the Betterley Report http://betterley.com/samples/cpims12_nt.pdf

News

Dignity Health, CHI Merging to Form New Catholic Health System

Catholic Health Initiatives (CHI), based in Englewood, Colorado, and San Francisco-based Dignity Health officially announced they are merging and have signed a definitive agreement to combine ministries and create a new, nonprofit Catholic health system.

HHS Announces Winning Solutions in Opioid Code-a-Thon

The U.S. Department of Health and Human Services (HHS) hosted this week a first-of-its-kind two-day Code-a-Thon to use data and technology to develop new solutions to address the opioid epidemic.

In GAO Report, More Concern over VA VistA Modernization Project

A recent Government Accountability Office (GAO) report is calling into question the more than $1 billion that has been spent to modernize the Department of Veterans Affairs' (VA) health IT system.

Lawmakers Introduce Legislation Aimed at Improving Medicare ACO Program

U.S. Representatives Peter Welch (D-VT) and Rep. Diane Black (R-TN) have introduced H.R. 4580, the ACO Improvement Act of 2017 that makes changes to the Medicare accountable care organization (ACO) program.

Humana Develops Medication Management Tool

A new tool developed by Humana enables the company’s members to keep a list of their medications in one place.

Four Hospitals Piloting OurNotes Initiative in 2018

Beginning in January, four academic hospitals—Beth Israel Deaconess Medical Center in Boston, University of Washington in Seattle, Dartmouth-Hitchcock Medical Center in Lebanon, New Hampshire and University of Colorado in Boulder—will begin piloting a new digital tool called OurNotes that enables patients to contribute to their clinical notes.