Skip to content
DWT logo
People Services Insights
About Offices Careers
Search
People
Services
Insights
About
Offices
Careers
Search
Advisories
Healthcare

It’s Not Enough to Notify: Don’t Forget the Policies, Risk Analyses, and Training

By Rebecca L. Williams, Adam H. Greene, and Sarah S. Fallows
01.06.14
Share
Print this page

HIPAA compliance ended with a bang in 2013, with the feds issuing the first settlement involving a health provider’s failure to have breach notification policies and procedures in place. On Dec. 24, 2013, the Department of Health and Human Services Office for Civil Rights (OCR) entered into a Resolution Agreement with Adult & Pediatric Dermatology, P.C. (AP Derm) that included a settlement of $150,000 and a corrective action plan.

OCR initiated its investigation after receiving notification of a breach of the health information of approximately 2,200 individuals. In an all-too-common scenario, the information was located on an unencrypted thumb drive stolen from the vehicle of an AP Derm workforce member and never recovered.

Although AP Derm reported the breach to OCR, notified patients of the theft within 30 days, and provided media notice, OCR still required financial settlement and a corrective action plan due to AP Derm’s alleged failure to:

  • Conduct an accurate and thorough analysis of the potential risks and vulnerabilities to the confidentiality of electronic protected health information (ePHI) as part of its security management process;
  • Fully comply with the administrative requirements of the Breach Notification Rule by having written policies and procedures in place and training workforce members; and
  • Reasonably safeguard the unencrypted thumb drive that was stolen from the workforce member’s vehicle.

Lessons learned
The settlement highlights the importance of creating and implementing breach-related policies, procedures, and training.  Even if an entity appropriately provides breach notification, a lack of written policies may lead to enforcement actions by OCR. Moreover, appropriate training of workforce on safeguarding ePHI, including an emphasis on not leaving health information unattended, particularly in a parked vehicle, may avoid the breach in the first place.

As with previous settlements, OCR continues to emphasize the importance of an adequate Security Rule risk analysis for all ePHI. Covered entities and business associates who fail to conduct a risk analysis before a breach occurs potentially face performing one under the close and extended supervision of OCR.

For covered entities and business associates, adequate policies, procedures, workforce training, and risk management plans may not only help prevent and mitigate breaches of health information, but also unpleasant and costly encounters with OCR.

Related Articles

2025
Feature
Financial Services
New Administration Outlook: Helping You Navigate Post-Election Uncertainty in 2025 and Beyond Read More External Link
05.22.25
Insights
White Collar, Investigations & Government Controversies
DOJ Criminal Division Reveals New White-Collar Crime Enforcement Priorities and Corporate Enforcement Policies Read More
04.02.25
Insights
Litigation
Delaware Enacts Sweeping Changes to the Delaware General Corporation Law Read More
DWT logo
©1996-2025 Davis Wright Tremaine LLP. ALL RIGHTS RESERVED. Attorney Advertising. Not intended as legal advice. Prior results do not guarantee a similar outcome.
Media Kit Affiliations Legal notices
Privacy policy Employees DWT Collaborate EEO
SUBSCRIBE
©1996-2025 Davis Wright Tremaine LLP. ALL RIGHTS RESERVED. Attorney Advertising. Not intended as legal advice. Prior results do not guarantee a similar outcome.