{"id":7556,"date":"2018-12-11T17:11:35","date_gmt":"2018-12-12T01:11:35","guid":{"rendered":"http:\/\/www.infosecurity.pro\/?p=7556"},"modified":"2019-04-20T16:24:09","modified_gmt":"2019-04-20T16:24:09","slug":"psmc-to-pay-111400-in-hipaa-violations","status":"publish","type":"post","link":"https:\/\/www.infosecurity.pro\/?p=7556","title":{"rendered":"PSMC to pay $111,400 in HIPAA Violations"},"content":{"rendered":"<p>\t\t\t\t<![CDATA[\n\n<p><font color=\"#1F497D\" size=\"4\"><b>Colorado hospital failed to terminate former employee&rsquo;s access to electronic protected health information<\/b><\/font><\/p>\n\n\n\n\n<p><font color=\"#1F497D\">&nbsp;<\/font><\/p>\n\n\n\n\n<p><font face=\"Helvetica\" size=\"2\">Pagosa Springs Medical Center (PSMC) has <a href=\"https:\/\/www.hhs.gov\/sites\/default\/files\/pagosa-springs-medical-center-signed-ra-cap.pdf\" target=\"_blank\" rel=\"noopener noreferrer\">agreed<\/a> to pay $111,400 to the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services and to adopt a substantial corrective action plan to settle potential violations of the Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security Rules.&nbsp; PSMC is a critical access hospital, that at the time of OCR&rsquo;s investigation, provided more than 17,000 hospital and clinic visits annually and employs more than 175 individuals.<\/font><\/p>\n\n\n\n\n<p><font face=\"Helvetica\" size=\"2\">The settlement resolves a complaint alleging that a former PSMC employee continued to have remote access to PSMC&rsquo;s web-based scheduling calendar, which contained patients&rsquo; electronic protected health information (ePHI), after separation of employment. OCR&rsquo;s investigation revealed that PSMC impermissibly disclosed the ePHI of 557 individuals to its former employee and to the web-based scheduling calendar vendor without a HIPAA required business associate agreement in place.<\/font><\/p>\n\n\n\n\n<p><font face=\"Helvetica\" size=\"2\">Under the two-year corrective action plan, PSMC has agreed to update its security management and business associate agreement, policies and procedures, and train its workforce members regarding the same.<\/font><\/p>\n\n\n\n\n<p><font face=\"Helvetica\" size=\"2\">Covered entities that do not have or follow procedures to terminate information access privileges upon employee separation risk a HIPAA enforcement action. Covered entities must also evaluate relationships with vendors to ensure that business associate agreements are in place with all business associates before disclosing protected health information.&nbsp; The resolution agreement and corrective action plan may be found on the OCR website at&nbsp;<a data-saferedirecturl=\"https:\/\/www.google.com\/url?q=http:\/\/www.hhs.gov\/hipaa\/for-professionals\/compliance-enforcement\/agreements\/pagosasprings&amp;source=gmail&amp;ust=1544662896254000&amp;usg=AFQjCNFT4QLncLqMsvnY6oD1DlzIeGH0OA\" href=\"http:\/\/www.hhs.gov\/hipaa\/for-professionals\/compliance-enforcement\/agreements\/pagosasprings\" target=\"_blank\" rel=\"noopener noreferrer\"><font color=\"#0053CC\"><u>http:\/\/www.hhs.gov\/hipaa\/for-<wbr \/>professionals\/compliance-<wbr \/>enforcement\/agreements\/<wbr \/>pagosasprings<\/u><\/font><\/a>.<\/font><\/p>\n\n\n\n\n<p><font face=\"Helvetica\" size=\"2\">###<\/font><\/p>\n\n\n]]>\t\t<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\t\t\t\t<![CDATA[]]>\t\t<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"amazonpipp_noncename":"","amazon-product-isactive":"","amazon-product-single-asin":"","amazon-product-content-location":"","amazon-product-content-hook-override":"","amazon-product-excerpt-hook-override":"","amazon-product-singular-only":"","amazon-product-amazon-desc":"","amazon-product-show-gallery":"","amazon-product-show-features":"","amazon-product-newwindow":"","amazon-product-show-list-price":"","amazon-product-show-used-price":"","amazon-product-show-saved-amt":"","amazon-product-timestamp":"","amazon-product-new-title":"","amazon-product-use-cartURL":"","amazon_featured_post_meta_key":"","_amazon_featured_alt":"","amazon-product-template":"","footnotes":""},"categories":[66],"tags":[],"class_list":["post-7556","post","type-post","status-publish","format-standard","hentry","category-breaches"],"_links":{"self":[{"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=\/wp\/v2\/posts\/7556","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=7556"}],"version-history":[{"count":1,"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=\/wp\/v2\/posts\/7556\/revisions"}],"predecessor-version":[{"id":7790,"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=\/wp\/v2\/posts\/7556\/revisions\/7790"}],"wp:attachment":[{"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7556"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7556"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7556"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}