The Office for Civil Rights in the US Department of Health and Human Services (OCR) recently announced a $3 Million settlement with a diagnostic medical imaging company related to potential violations of the HIPAA Security and Breach Notification Rules. This settlement, according to JDSupra, arose out of an FTP server which allowed access to protected health information visible on the internet. OCR noted in its press release that notifications to individuals affected by the breach were untimely, an accurate and thorough risk analysis was not conducted, and that business associate agreements were not in place with vendors.
The lack of a risk analysis and appropriate business associate agreements are common themes seen in settlements and therefore should be appropriately considered in conducting due diligence.
At HIPAAcraticRx, due diligence is our middle name! We help your practice or business complete the legwork, so you maintain an archive of compliance activities. This includes a Security Risk Analysis (SRA), mitigation, and staff training … among other key items. Contact the compliance experts at HIPAAcraticRx today.