2018 was a year of serious HIPAA Enforcement. Between the Vice Lords Gang, FileFax, and Anthem, there was no shortage of HIPAA cases.
Since 2003 the establishment of the Enforcement Act, an addendum to HIPAA that gave the OCR the right to enforce HIPAA on behalf of the HHS, we’ve seen an ever increasing number of fines and breaches. The OCR first targeted massive healthcare companies like Anthem, as well as companies involved in egregious violations.
But now more than ever, we see a wide variety of businesses receiving fines for violations that are much more commonplace. We’ve collected some of the most shocking breach incidents in 2018 for your compliance pleasure.
In late 2015 and early 2016, the Vice Lords Gang and their associates carried out a witness tampering scheme in Eastern Detroit. The gang knew that 3 shooting victims had been treated at a specific medical center in Detroit, and that the brother of one of their members was an employee there.
The hospital worker, at the behest of the Vice Lords, illegally accessed a database containing PHI (Protected Health Information) of every patient that had been treated at that medical center and gathered names, addresses, and phone numbers of the shooting victims family members. The hospital worker then provided this information to the Vice Lords who attempted to use the information to harass the victims’ families and prevent them from cooperating with investigators.
Back in 2015 (apparently a bad year for data privacy), Filefax was up and operating as a medical record storage, transport, and delivery vendor. However, their privacy practices left much to be desired.
The OCR received an anonymous tip that a Filefax employee was selling patient records on the side. After initiating an investigation, the OCR also found that patient records belonging to a FileFax client were being stored in a dumpster outside of the FileFax office. With the OCR breathing down their neck, FileFax closed its doors amid scrutiny and ongoing investigations.
Three Boston-area hospitals involved in the filming of the trauma reality show “Save My Life: Boston Trauma” have paid a total of $1 million in fines to the OCR after allowing film crews to film patients at their facilities without consent. The ABC film crew was also given complete access to the hospital, including rooms where medical records were stored.
This is not the first time a real life trauma show has violated patient privacy rights.In 2016, NY Presbyterian hospital allowed the Dr. Oz show to film at their facility, which resulted in a wife of a man who had passed away seeing herself on TV as the doctor notified her of her husband’s death.
Let’s warp back in time… the year is… 2015. Data is falling out of everyone’s pockets and into the greedy hands of the dark web.
At Anthem, hackers deployed a phishing campaign to capture passwords and user IDs of Anthem employees. The hackers were able to steal ePHI of nearly 79 million individuals, including names, security numbers, medical IDs, email addresses, and employment information, making this the largest data breach in history.
Unfortunately, Anthem lacked even a moderately developed compliance program and had failed to implement the basics including a risk assessment, information system activity review, and a process for responding to security incidents. For shame!
So what have we learned from all these violations?
Well for one, the OCR takes about 3 years to resolve incidents including investigation, lawsuit, and fines. So we might have to wait until 2021 for the year 2018 to reveal its secrets.
Will all this enforcement activity result in fewer violations and fines or will the OCR continue to be supplied with egregious violations from negligent companies? Stay tuned to find out!