HIPAA Compliance Blog

The HHS Office for Civil Rights (OCR) announced on December 4, 2018, that Advanced Care Hospitalists PL (ACH), operating in West Central Florida, agreed to a settlement of $500,000 and to adopt a substantial Corrective Action Plan (CAP) regarding potential HIPAA violations arising out of security breaches caused by hiring a billing contractor without implementing a Business Associate Agreement (BAA).

According to OCR Director Roger Severino, “it’s common sense that former employees should immediately lose access to protected patient information upon their separation from employment.”

Just because a member of an organization’s workforce violates HIPAA policies and procedures, it is not necessarily a breach reporting requirement.

An easy way to figure out if you or your company is a BA is by asking this question?

Anthem, Inc., a defined Business Associate that provided administrative support services for the Anthem Affiliated Covered Entities (Anthem ACE), has committed to a $16 million settlement to the U.S. Department of Health and Human Services, Office for Civil Rights (OCR). This is the largest settlement ever announced by OCR.