Stolen Thumb Drive Costs Dermatology Practice $150K | Healthcare Informatics Magazine | Health IT | Information Technology Skip to content Skip to navigation

Stolen Thumb Drive Costs Dermatology Practice $150K

December 31, 2013
by Rajiv Leventhal
| Reprints

A stolen unencrypted thumb drive containing the electronic protected health information (ePHI) of approximately 2,200 individuals has cost a dermatology practice $150,000 following a settlement with the Department of Health and Human Services (HHS).

The Concord, Mass.-based Adult & Pediatric Dermatology (APDerm), which delivers dermatology services in four locations in Massachusetts and two in New Hampshire, will also be required to implement a corrective action plan to correct deficiencies in its HIPAA (Health Insurance Portability and Accountability Act) compliance program.

According to HHS, this case marks the first settlement with a covered entity for not having policies and procedures in place to address the breach notification provisions of the Health Information Technology for Economic and Clinical Health (HITECH) Act, passed as part of American Recovery and Reinvestment Act of 2009 (ARRA).

The investigation of APDerm opened by the HHS Office for Civil Rights (OCR) found that the unencrypted thumb drive was stolen was stolen from a vehicle of one its staff members. The thumb drive was never recovered.

The investigation revealed that the practice had not conducted an accurate and thorough analysis of the potential risks and vulnerabilities to the confidentiality of ePHI as part of its security management process.  Further, APDerm did not fully comply with requirements of the HITECH Breach Notification Rule to have in place written policies and procedures and train workforce members.

“As we say in healthcare, an ounce of prevention is worth a pound of cure,” OCR director Leon Rodriguez said in a statement. “That is what a good risk management process is all about—identifying and mitigating the risk before a bad thing happens.  Covered entities of all sizes need to give priority to securing electronic protected health information.”

In addition to a $150,000 resolution amount, the settlement includes a corrective action plan requiring APDerm to develop a risk analysis and risk management plan to address and mitigate any security risks and vulnerabilities, as well as to provide an implementation report to OCR.

Topics

News

Former Michigan Governor to Serve as Chair of DRIVE Health

Former Michigan Governor John Engler will serve as chair of the DRIVE Health Initiative, a campaign aimed at accelerating the U.S. health system's transition to value-based care.

NJ Medical Group Launches Statewide HIE, OneHealth New Jersey

The Medical Society of New Jersey (MSNJ) recently launched OneHealth New Jersey, a statewide health information exchange (HIE) that is now live.

Survey: 70% of Providers Using Off-Premises Computing for Some Applications

A survey conducted by KLAS Research found that 70 percent of healthcare organizations have moved at least some applications or IT infrastructure off-premises.

AMIA Warns of Tax Bill’s Impact on Graduate School Programs in Informatics

Provisions in the Republican tax bill that would count graduate student tuition waivers as taxable income would have detrimental impacts on the viability of fields such as informatics, according to the American Medical Informatics Association.

Appalachia Project to Study Relationship Between Increased Broadband Access, Improved Cancer Care

The Federal Communications Commission and the National Cancer Institute have joined forces to focus on how increasing broadband access and adoption in rural areas can improve the lives of rural cancer patients.

Survey: By 2019, 60% of Medicare Revenues will be Tied to Risk

Medical groups and health systems that are members of AMGA (the American Medical Group Association) expect that nearly 60 percent of their revenues from Medicare will be from risk-based products by 2019, according to the results from a recent survey.