Practice hit by $150K fine for lacking thorough security policies

A Massachusetts dermatology practice has agreed to a $150,000 settlement for privacy and security violations. Adult & Pediatric Dermatology, which offers services in Massachsuetts and New Hampshire, also is required to put a corrective action plan in place to fix deficiencies in its HIPAA compliance program, according to the settlement with the Department of Health and Human Services (HHS).

The investigation by HHS' Office of Civil Rights originated with an unencrypted USB drive that contained the protected health information (PHI) of about 2,200 people and was stolen from a vehicle of one of its staff members. The investigation revealed that the practice had not conducted an accurate and thorough analysis of the potential risks and vulnerabilities to the confidentiality of PHI as part of its security management process, officials say.

It's the first settlement with a covered entity for not having policies and procedures in place to address the breach notification provisions of the HITECH Act, say officicials from HHS' Office for Civil Rights (OCR).

"As we say in healthcare, an ounce of prevention is worth a pound of cure," said OCR Director Leon Rodriguez, in a press statement. "That is what a good risk management process is all about—identifying and mitigating the risk before a bad thing happens. Covered entities of all sizes need to give priority to securing electronic protected health information."