CardioNet Agrees to $2.5 Million HIPAA Settlement with HHS

"Mobile devices in the health care sector remain particularly vulnerable to theft and loss," said Roger Severino, director of the HHS Office for Civil Righst. "Failure to implement mobile device security by Covered Entities and Business Associates puts individuals' sensitive health information at risk."

The U.S. Department of Health and Human Services' Office for Civil Rights announced that CardioNet (a company owned by BioTelemetry, Inc. of Malvern, Pa.) has agreed to settle potential noncompliance with the HIPAA Privacy and Security Rules by paying $2.5 million and implementing a corrective action plan.

This Health Insurance Portability and Accountability Act of 1996 (HIPAA) settlement is based on the impermissible disclosure of unsecured electronic protected health information (ePHI) and is the first one that involves a wireless health services provider, according to HHS.

CardioNet provides Mobile Cardiac Outpatient Telemetry -- remote mobile monitoring of and rapid response to patients at risk for cardiac arrhythmias.

According to HHS, in January 2012, CardioNet reported to the Office for Civil Rights that an employee's laptop was stolen from a parked vehicle outside that employee's home. "The laptop contained ePHI of 1,391 individuals. OCR's investigation into the impermissible disclosure revealed that CardioNet had an insufficient risk analysis and risk management processes in place at the time of the theft. Additionally, CardioNet's policies and procedures implementing the standards of the HIPAA Security Rule were in draft form and had not been implemented. Further, the Pennsylvania-based organization was unable to produce any final policies or procedures regarding the implementation of safeguards for ePHI, including those for mobile devices," HHS reported.

"Mobile devices in the health care sector remain particularly vulnerable to theft and loss," said Roger Severino, OCR's director. "Failure to implement mobile device security by Covered Entities and Business Associates puts individuals' sensitive health information at risk. This disregard for security can result in a serious breach, which affects each individual whose information is left unprotected."

The two parties' Resolution Agreement and Corrective Action Plan is available here.

Download Center

HTML - No Current Item Deck
  • Free Safety Management Software Demo

    IndustrySafe Safety Management Software helps organizations to improve safety by providing a comprehensive toolset of software modules to help businesses identify trouble spots; reduce claims, lost days, OSHA fines; and more.

  • Complete Online Safety Training Courses

    Deliver state-of-the art, online safety training courses to your organization with IndustrySafe Training Management Software. Generate reports to track training compliance and automatically notify learners of upcoming or overdue classes.

  • Easy to Use Safety Inspection App

    Conduct inspections on the go with IndustrySafe’s mobile app. Complete safety audits at job sites and remote locations—with or without web access.

  • Track Key Safety Performance Indicators

    IndustrySafe’s Dashboard Module allows organizations to easily track safety KPIs and metrics. Gain increased visibility into your business’ operations and safety data.

  • Analyze Incident Data and Maintain OSHA Compliance

    Collect relevant incident data, analyze trends, and generate accurate regulatory reports, including OSHA 300, 300A, and 301 logs, through IndustrySafe’s extensive incident reporting and investigation module.

  • Industry Safe
comments powered by Disqus