Presence Health first to be fined for delayed breach notification
HHS’s Office of Civil Rights (OCR) announced its first HIPAA enforcement action based solely on a healthcare facility not reporting a data breach in a timely manner.
Chicago-based Presence Health agreed to pay $475,000 for the violation. The breach itself occurred on Oct. 22, 2013, when operating schedules containing protected health information of more than 800 patients was discovered to be missing from the Presence St. Joseph Medical Center in Joliet, Illinois. The information included names, dates of birth, medical record numbers, names and dates of procedures, and names of surgeons.
Presence didn’t report the breach to OCR until Jan. 31, 2014, past the 60-day notification deadline. It also failed to meet the 60-day standard on notifying the patients (who weren’t told until Feb. 3, 2014) and media outlets (which weren’t informed until Feb. 5, 2014). The 60-day notification to “prominent media outlets” is required with breaches affecting 500 patients or more.
“Covered entities need to have a clear policy and procedures in place to respond to the Breach Notification Rule’s timeliness requirements” OCR Director Jocelyn Samuels said in a statement. “Individuals need prompt notice of a breach of their unsecured PHI so they can take action that could help mitigate any potential harm caused by the breach.”
During the investigation, OCR found that Presence had also waited too long to notify patients affected by smaller breaches in 2015 and 2016.
John joined TriMed in 2016, focusing on healthcare policy and regulation. After graduating from Columbia College Chicago, he worked at FM News Chicago and Rivet News Radio, and worked on the state government and politics beat for the Illinois Radio Network. Outside of work, you may find him adding to his never-ending graphic novel collection.