Sometimes when the HHS Office for Civil Rights (OCR) issues a settlement agreement resolving alleged violations of HIPAA, the organization being sanctioned is mum, or perhaps issues a rote statement indicating that security is important.

Medical Informatics Engineering (MIE) took a little different tack. After its $100,000 settlement that includes a two-year corrective action plan was announced, it issued a press release, and its founder and CEO Doug Horner answered RPP’s questions about the settlement and what MIE had learned from the experience.

Horner had more than just the OCR settlement to discuss. Also on May 23, Horner’s medical records firm settled with 16 attorneys general (AGs) who had sued last year over the same breach, which exposed protected health information (PHI) of 3.9 million individuals (see story, p. 1).

Between the two settlements, MIE is to pay $1 million ($900,000 to the states in three annual payments). Four years after the breach, there’s still no evidence that any individuals’ PHI was misused, Horner says.

MIE’s “monitoring systems” caught an attack on May 26, 2015, and “we immediately reported it,” Horner recalls. “We partnered with a team of third-party experts and the FBI to rapidly remediate attack vectors used by the intruders.”