11 May 2014 - 9:52am | posted by | 0 comments

US health care firms pay $4.8m in damages after 6,800 patient records leaked to web

US health care firms pay $4.8m in damages after 6,800 patient records leaked to web US health care firms pay $4.8m in damages after 6,800 patient records

Two US health care outlets - Columbia University and the New York and Presbyterian Hospital (NYP) - have paid a whopping $4.8m to settle charges after they inadvertently leaked the records of 6,800 patients on the web.

This week the judgment was passed – four years after the incident - that they violated the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy and Security Rules by failing to secure thousands of patients’ electronic protected health information held on their network.

On the US department of Health and Human Services website it stated that the investigation revealed the data breach happened when a physician employed by Columbia University tried to deactivate a personally-owned computer server on the network which contained NYP and the network of patient data.

Due to a lack of technical safeguards this action resulted in the data being made accessible on internet search engines.

The health care organisations were apprised of the breach after receiving a complaint from an individual who found details of their deceased partner – a former patient of NYP – on the internet.

The Office for Civil Rights (OCR) investigation discovered that neither outlet had taken measures to ensure the server had the appropriate software protections prior to the breach.

“When entities participate in joint compliance arrangements, they share the burden of addressing the risks to protected health information,” said Christina Heide, acting deputy director of Health Information Privacy for OCR.

“Our cases against NYP and CU should remind health care organizations of the need to make data security central to how they manage their information systems.”

In addition to the fine, both health care outlets will have to agree to a “substantive corrective action plan”, which includes undertaking a risk analysis, developing a risk management plan, revising policies and procedures, training staff, and providing progress reports.

Don't miss out... Get your Digital news by email

See all specialist newsletters

6 related companies from Profile Hub:

Be the first to comment on this article: sign in or register.

Latest Projects from the Profile Hub

Case Study | RLH

01/09/2014
Chris Ross, MD of full-service B2B advertising agency RLH,...

Brand new logo design for The Scottish Graduate School for Arts and Humanities

29/08/2014
The Scottish Graduate School for Arts and Humanities (SGSAH...

DrupalCon 2014

27/08/2014
We were selected by the Drupal Association through a...

New Forest National Park - Young David Attenborough discovers the Tech Creche

21/08/2014
Research conducted by the New Forest National Park...

Social Media Training

18/08/2014
We love to share what we know and what we've learned about...