N.C. provider to pay $750,000 to settle HIPAA violations

Raleigh Orthopaedic Clinic of North Carolina will pay $750,000 to settle HIPAA violation charges.

The practice allegedly handed over protected health information for approximately 17,300 patients to a potential business partner without first executing a business associate agreement, according to the Office of Civil Rights (OCR).

The law requires that HIPAA-covered entities not disclose protected health information without authorization—a business associate agreement safeguards such information to prevent misuse or improper disclosure.

"HIPAA's obligation on covered entities to obtain business associate agreements is more than a mere check-the-box paperwork exercise," OCR Director Jocelyn Samuels said in a statement. "It is critical for entities to know to whom they are handing personal health information and to obtain assurances that the information will be protected." OCR's investigation of the provider began with a breach report on April 30, 2013. The agency found that Raleigh Orthopaedic released x-ray films and related protected health information of 17,300 patients to a group that was going to transfer the images to electronic media in exchange for harvesting the silver from the films. Raleigh Orthopedic allegedly failed to execute a business associate agreement with this company prior to turning over the x-rays and health information.

In addition to the $750,000 payment, Raleigh Orthopaedic is required to revise its policies and procedures to establish a process for assessing whether entities are business associates. The provider also is required to designate a "responsible individual" to ensure business associate agreements are in place prior to disclosing public health information to a business associate; create a standard template business associate agreement; and establish a standard process for maintaining documentation of business associate agreements for at least six years beyond the date of termination of such a relationship. The group must limit disclosures of personal health information to any business associate to the minimum necessary to accomplish the purpose for which it was hired.