Idaho university to pay $400K for HIPAA violations

Idaho State University (ISU) will pay $400,000 to the Department of Health and Human Services (HHS) to settle alleged violations of the HIPAA Security Rule. The settlement comes after ISU’s Pocatello Family Medicine Clinic disabled server firewall protections for a period of at least 10 months, resulting in the breach of electronic protected health information (ePHI) for 17,500 patients. 

ISU operates 29 outpatient clinics and is required to provide health IT systems security at those clinics. Between four and eight of the ISU clinics are subject to the HIPAA Privacy and Security Rules, including the clinic where the breach occurred, HHS officials say. 

The HHS Office for Civil Rights opened an investigation in November 2011 after ISU's August 2011 notification of the breach, which resulted from disabling of firewall protections at servers maintained by ISU. Over the course of the investigation, agency officials found that, for more than three years, ISU’s risk analyses and assessments of its clinics were incomplete and inadequately identified potential risks or vulnerabilities. ISU also failed to assess the likelihood of potential risks occurring.   

OCR concluded that ISU did not apply proper security measures and policies to address risks to ePHI and did not have procedures for routine review of its information system in place, which could have detected the firewall breach much sooner. ISU has agreed to a comprehensive corrective action plan to address the issues uncovered by the investigation and its failure to ensure uniform implementation of required HIPAA Security Rule protections at each of its covered clinics. To date, OCR has collected $15.3 million relating to HIPAA violations and settlements.  

The release of the omnibus privacy rule in March came with a wealth of advice on how to improve compliance.