Presence Health first to be fined for delayed breach notification

HHS’s Office of Civil Rights (OCR) announced its first HIPAA enforcement action based solely on a healthcare facility not reporting a data breach in a timely manner.

Chicago-based Presence Health agreed to pay $475,000 for the violation. The breach itself occurred on Oct. 22, 2013, when operating schedules containing protected health information of more than 800 patients was discovered to be missing from the Presence St. Joseph Medical Center in Joliet, Illinois. The information included names, dates of birth, medical record numbers, names and dates of procedures, and names of surgeons.

Presence didn’t report the breach to OCR until Jan. 31, 2014, past the 60-day notification deadline. It also failed to meet the 60-day standard on notifying the patients (who weren’t told until Feb. 3, 2014) and media outlets (which weren’t informed until Feb. 5, 2014). The 60-day notification to “prominent media outlets” is required with breaches affecting 500 patients or more.

“Covered entities need to have a clear policy and procedures in place to respond to the Breach Notification Rule’s timeliness requirements” OCR Director Jocelyn Samuels said in a statement. “Individuals need prompt notice of a breach of their unsecured PHI so they can take action that could help mitigate any potential harm caused by the breach.”

During the investigation, OCR found that Presence had also waited too long to notify patients affected by smaller breaches in 2015 and 2016.