Table of Contents
Every compliance officer, privacy specialist, security expert or other individual with HIPAA-related duties knows one way to learn what not to do is to pore over the enforcement actions the HHS Office for Civil Rights (OCR) takes against errant covered entities (CEs) and business associates (BAs).
Typically OCR’s enforcement actions take the form of a voluntary settlement agreement that includes a financial payment and a corrective action plan (CAP); both generally sketch the outlines of what went wrong. So the health care compliance community was in for a treat when Serena Mosley-Day, OCR’s acting senior advisor for HIPAA compliance and enforcement, revealed some of the backstories and details of settlements she helped negotiate.
For ease of recall, Mosley-Day says she often gives her cases nicknames—including “it’s five o’clock somewhere.” This issue of RPP will discuss the case that gave rise to that nickname, which Mosley-Day said shows the value of auditing users’ access.
Staying in OCR’s good graces has always been critical, but as multimillion-dollar settlements have proliferated in recent years, the stakes have never been higher. Last year, OCR had 10 settlements that brought the agency $19.4 million, which earned it second place (RPP 1/17, p. 1). In first place is 2016, during which OCR had 13 enforcement actions with $24.5 million in financial payments (RPP 12/16, p. 1).
The “five o’clock” case is one from February 2017 involving Memorial Healthcare System (MHS) of South Florida, which was triggered by two unrelated breaches. MHS paid OCR $5.5 million and agreed to an extensive three-year CAP that called for an external monitor (RPP 3/17, p. 1).
To date, MHS is tied for the record of highest payment to OCR. In 2016, Advocate Health Care also paid $5.5 million following the theft of desktop computers holding records for 4 million individuals (RPP 9/16, p. 1). MHS bills itself as one of the nation’s largest public health systems, consisting of a half-dozen hospitals, a nursing home, an urgent care center and other facilities.
