In its recent settlement with L.A. Care Health Plan (LACHP), the HHS Office for Civil Rights (OCR) accused the plan of violating four provisions in the Security Rule. LACHP did not admit to wrongdoing but agreed to follow an extensive, three-year corrective action plan (CAP), OCR announced last month (see story, p. 1).[1] L.A. Care also paid $1.3 million as part of the settlement.
The settlement was triggered by breaches in 2014 and 2019 that collectively affected 2,250, L.A. Care officials told RPP in a statement, which added, “members’ data was inadvertently shared with individuals other than the member.”
In the settlement documents, OCR said L.A. Care “potentially” violated the following related to the loss of electronic protected health information (ePHI).[2]
-
“The requirement to conduct an accurate and thorough risk analysis of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of all ePHI held by LACHP (See 45 C.F.R. § 164.308(a)(1)(ii)(A)).
-
“The requirement to implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level. (See 45 C.F.R. § 164.308(a)(1)(ii)(B).)
-
“The requirement to implement sufficient procedures to regularly review records of information system activity (See 45 C.F.R. § 164.308(a)(1)(ii)(D).)
-
“The requirement to perform a periodic technical and nontechnical evaluation, based initially upon the standards implemented under this rule and subsequently, in response to environmental or operational changes affecting the security of ePHI. (See 45 CFR F.R. § 164.308(a)(8).)
-
“The requirement to implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use ePHI. (See 45 C.F.R. 164.312(b)).”
