South Shore Hospital to pay $750,000 for data breach
South Shore Hospital in Boston has agreed to pay $750,000 to resolve allegations that it failed to protect the personal and confidential health information of more than 800,000 consumers, Massachusetts Attorney General Martha Coakley announced recently.
The investigation and settlement resulted from a data breach reported to the attorney general's office in July 2010 that included individual's names, Social Security numbers, financial account numbers, and medical diagnoses.
"Hospitals and other entities that handle personal and protected health information have an obligation to properly protect this sensitive data, whether it is in paper or electronic form," Coakley said. "It is their responsibility to understand and comply with the laws of our commonwealth and to take the necessary actions to ensure that all affected consumers are aware of a data breach."
The consent judgment includes a $250,000 civil penalty and a payment of $225,000 for an education fund to be used by the attorney general's office to promote education concerning the protection of personal information and protected health information. In addition to these payments, the consent judgment calls for another $275,000 in damages but credits South Shore Hospital for that amount already spent on security measures it took subsequent to the breach.
In February 2010, South Shore Hospital shipped three boxes containing 473 unencrypted back-up computer tapes with 800,000 individuals' personal information and protected health information off-site to be erased. The hospital contracted with Archive Data Solutions to erase the back-up tapes and resell them.
The hospital did not inform Archive Data, however, that personal information and protected health information were on the back-up computer tapes, nor did South Shore Hospital determine whether Archive Data had sufficient safeguards to protect this sensitive information. Multiple companies handled the shipping of the boxes containing the tapes.
In June 2010, South Shore Hospital learned that only one of the boxes arrived at its destination in Texas. The missing boxes have not been recovered, although there have been no reports of unauthorized use of the personal information or protected health information of affected individuals.
The allegations against South Shore Hospital in the lawsuit are based on federal and state law violations, including failing to implement appropriate safeguards, policies, and procedures to protect consumers' information, failing to have a business associate agreement in place with Archive Data, and failing to properly train its workforce with respect to health data privacy.
According to the consent judgment, South Shore Hospital has also agreed to take a variety of steps to ensure compliance with state and federal data security laws and regulations, including requirements regarding its contracts with business associates and third-party service providers engaged for data destruction purposes. The hospital also agreed to undergo a review and audit of certain security measures and to report the results and any corrective actions to the attorney general.
South Shore Hospital in Boston has agreed to pay $750,000 to resolve allegations that it failed to protect the personal and confidential health information of more than 800,000 consumers, Massachusetts Attorney General Martha Coakley announced recently.You have reached your article limit for the month. Subscribe now to access this article plus other member-only content.
- Award-winning Medical Content
- Latest Advances & Development in Medicine
- Unbiased Content