Blue Cross to pay $1.5M for HIPAA violations
Blue Cross Blue Shield of Tennessee (BCBST) has agreed to pay the Department of Health and Human Services (HHS) $1.5 million to settle potential violations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy and Security Rules. The enforcement action is the first resulting from a breach report required by the Health Information Technology for Economic and Clinical Health (HITECH) Act Breach Notification Rule.
BCBST also has agreed to a corrective action plan to address gaps in its HIPAA compliance program, according to Leon Rodriguez, director of the HHS Office for Civil Rights (OCR) in Washington, DC, who announced the settlement recently.
The investigation followed a notice submitted by BCBST to HHS reporting that 57 unencrypted computer hard drives were stolen from a leased facility in Tennessee. The drives contained the protected health information (PHI) of more than one million individuals, including member names, social security numbers, diagnosis codes, dates of birth, and health plan identification numbers.
OCR's investigation indicated BCBST failed to implement appropriate administrative safeguards to adequately protect information remaining at the leased facility by not performing the required security evaluation in response to operational changes. In addition, the investigation showed a failure to implement appropriate physical safeguards by not having adequate facility access controls; both of these safeguards are required by the HIPAA Security Rule.
"This settlement sends an important message that OCR expects health plans and healthcare providers to have in place a carefully designed, delivered, and monitored HIPAA compliance program," Rodriguez said. "The HITECH Breach Notification Rule is an important enforcement tool, and OCR will continue to vigorously protect patients' right to private and secure health information."
In addition to the $1.5 million settlement, the agreement requires BCBST to review, revise, and maintain its privacy and security policies and procedures, to conduct regular and robust trainings for all BCBST employees covering employee responsibilities under HIPAA, and to perform monitor reviews to ensure BCBST compliance with the corrective action plan.
Blue Cross Blue Shield of Tennessee (BCBST) has agreed to pay the Department of Health and Human Services (HHS) $1.5 million to settle potential violations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy and Security Rules. The enforcement action is the first resulting from a breach report required by the Health Information Technology for Economic and Clinical Health (HITECH) Act Breach Notification Rule.You have reached your article limit for the month. Subscribe now to access this article plus other member-only content.
- Award-winning Medical Content
- Latest Advances & Development in Medicine
- Unbiased Content