There has been a lot written recently about organizations that have received high profile HIPAA fines from the Office of Civil Rights (OCR). The Tennessee Blue Cross Blue Shield was handed a $1.5 million fine, Cignet Health was given a $4.3 million fine and Massachusetts General Hospital was awarded a $1 million fine.
The only problem with these fines is that they all were with large insurance companies or hospitals. Medical practices look at the “big boys” getting fined and don’t feel the enforcement pressure. But that has all changed. Phoenix Cardiac Surgery a small surgery center with 5 physicians was recently fined $100,000 by OCR for failing to protect patient information. Now $100,000 pales in comparison to a $4.3 million fine but given the size of the practice it still has to have a big impact.
Phoenix Cardiac Surgery was fined for not protecting patient information:
The incident giving rise to OCR’s investigation, according to an HHS news release, was a report that the physician practice was posting clinical and surgical appointments for its patients on an Internet-based calendar that was publicly accessible. While investigating the report, OCR found that Phoenix Cardiac Surgery had implemented few policies and procedures to comply with the HIPAA rules, and it had limited safeguards in place to protect patients’ electronic protected health information (ePHI).
Furthermore the OCR report specifically stated some of the lack of safeguards to protect patient information
- failed to implement adequate policies and procedures to appropriately safeguard patient information;
- failed to document that it trained any employees on its policies and procedures on the Privacy and Security Rules;
- failed to identify a security official and conduct a risk analysis; and
- failed to obtain business associate agreements with Internet-based email and calendar services where the provision of the service included storage of and access to its ePHI.
So they had no policies and procedures, did not perform a risk assessment, did not train their employees, did not appoint a security office and did not have business associates agreements. Basically they ignored the HIPAA Security Rule.
There is a good chance that if they ignored the HIPAA Security Rule they probably didn’t have HIPAA or Cyber insurance and this fine will directly hit their bottom-line. But beyond the fine let’s take a look at the impact to their reputation. Suppose you are a patient looking for a cardiac surgeon in Phoenix, AZ and you heard about Phoenix Cardiac Surgery. You would do what most people do and go to Google and do some research. Take a look at the results you would find.
Now maybe seeing all the stories about them receiving a HIPAA fine won’t stop you from going there but it may just make you think twice about how they are going to protect your information. This is a good example of why it is estimated that a healthcare breach cost around $240 per record. It is not only the HIPAA fines, breach notification expenses but it is also the loss of existing patients and loss of potential new patients.
It cost Phoenix Cardiac Surgery $100,000 for failing to implement the basic safeguards to protect patient information when it would have only cost them $1,750 to implement these safeguards. A costly but valuable less learned.