CardioNet Agrees to $2.5 Million HIPAA Settlement with HHS
"Mobile devices in the health care sector remain particularly vulnerable to theft and loss," said Roger Severino, director of the HHS Office for Civil Righst. "Failure to implement mobile device security by Covered Entities and Business Associates puts individuals' sensitive health information at risk."
The U.S. Department of Health and Human Services' Office for Civil Rights announced that CardioNet (a company owned by BioTelemetry, Inc. of Malvern, Pa.) has agreed to settle potential noncompliance with the HIPAA Privacy and Security Rules by paying $2.5 million and implementing a corrective action plan.
This Health Insurance Portability and Accountability Act of 1996 (HIPAA) settlement is based on the impermissible disclosure of unsecured electronic protected health information (ePHI) and is the first one that involves a wireless health services provider, according to HHS.
CardioNet provides Mobile Cardiac Outpatient Telemetry -- remote mobile monitoring of and rapid response to patients at risk for cardiac arrhythmias.
According to HHS, in January 2012, CardioNet reported to the Office for Civil Rights that an employee's laptop was stolen from a parked vehicle outside that employee's home. "The laptop contained ePHI of 1,391 individuals. OCR's investigation into the impermissible disclosure revealed that CardioNet had an insufficient risk analysis and risk management processes in place at the time of the theft. Additionally, CardioNet's policies and procedures implementing the standards of the HIPAA Security Rule were in draft form and had not been implemented. Further, the Pennsylvania-based organization was unable to produce any final policies or procedures regarding the implementation of safeguards for ePHI, including those for mobile devices," HHS reported.
"Mobile devices in the health care sector remain particularly vulnerable to theft and loss," said Roger Severino, OCR's director. "Failure to implement mobile device security by Covered Entities and Business Associates puts individuals' sensitive health information at risk. This disregard for security can result in a serious breach, which affects each individual whose information is left unprotected."
The two parties' Resolution Agreement and Corrective Action Plan is available here.