A Massachusetts hospital has been fined $218,400 and required to implement a HIPAA privacy and security corrective action plan under a settlement with the Department of Health and Human Services's Office for Civil Rights (OCR).
The OCR received a complaint in late 2012 that employees at St. Elizabeth’s Medical Center in Brighton were using an unsecured internet-based document sharing application that held protected health information for at least 498 individuals. The agency determined that the hospital “failed to timely identify and respond to the known security incident, mitigate the harmful effects of the security incident, and document the security incident and its outcome,” according to an OCR announcement.
St. Elizabeth's did not properly notify OCR of the breach in 2012, but in August 2014 reported another breach that affected 595 individuals after protected health information was found on a former employee’s personal laptop and USB drive.
Editor
Editor Beth earned a bachelor’s degree in journalism and master’s in health communication. She has worked in hospital, academic and publishing settings over the past 20 years. Beth joined TriMed in 2005, as editor of CMIO and Clinical Innovation + Technology. When not covering all things related to health IT, she spends time with her husband and three children.