HIPAA Breach Fine: $6666 Per Patient File

In this year’s first HIPAA settlement, Fresenius Medical Care North America has agreed to pay a $3.5 million file to resolve HIPAA violations that came to light as a result of five data breaches that happened six years ago.

The five breaches occurred at five separate Covered Entities, all owned FMCNA.  In all, a total of 525 patient records were exposed.

​The 2012 patient data breaches resulted from theft of two desktop computers, theft of an unencrypted USB drive, a missing or stolen computer hard drive, theft of an unencrypted laptop, and an office break-in in which three desktops and an encrypted laptop were stolen.
 
The Office for Civil Rights, the regulatory body charged with HIPAA enforcement, launched an investigation into the breaches to determine whether they resulted from failure to comply with HIPAA requirements.  OCR noted that FMCNA had failed to conduct a HIPAA Risk Assessment, had provided unauthorized access to patient records, failed to implement computer hardware security policies, failed to safeguard facilities and had no policies or procedures in place to address security breaches.
 
HIPAA Journal noted that the $3.5 million settlement “reflects the seriousness and extent of HIPAA violations,” showing that “it is not the size of the breach that matters.”  The settlement is a clear indication that OCR is investigating smaller breaches and – when HIPAA rules are violated – the Covered Entity can expect a substantial financial penalty.