Large hospital system to improve policies and procedures safeguarding patient information
Mass General, one of the nation’s oldest and largest hospitals, signed a Resolution Agreement with HHS that requires it to develop and implement a comprehensive set of policies and procedures to safeguard the privacy of its patients. The settlement follows an extensive investigation by the
“We hope the health care industry will take a close look at this agreement and recognize that OCR is serious about HIPAA enforcement. It is a covered entity’s responsibility to protect its patients’ health information,” said OCR Director
The incident giving rise to the agreement involved the loss of protected health information (PHI) of 192 patients of Mass General’s
The impermissible disclosure of PHI involved the loss of documents consisting of a patient schedule containing names and medical record numbers for a group of 192 patients, and billing encounter forms containing the name, date of birth, medical record number, health insurer and policy number, diagnosis and name of providers for 66 of those patients. These documents were lost on
Mass General also agreed to enter into a Corrective Action Plan (CAP), which requires the hospital to:
- Develop and implement a comprehensive set of policies and procedures that ensure PHI is protected when removed from Mass General’s premises;
- Train workforce members on these policies and procedures; and
- Designate the Director of Internal Audit Services of
Partners HealthCare System Inc.to serve as an internal monitor who will conduct assessments of Mass General’s compliance with the CAP and render semi-annual reports to HHS for a 3-year period.
“To avoid enforcement penalties, covered entities must ensure they are always in compliance with the HIPAA Privacy and Security Rules,” said Verdugo. “A robust compliance program includes employee training, vigilant implementation of policies and procedures, regular internal audits, and a prompt action plan to respond to incidents.”
The HHS Resolution Agreement and CAP can be found on the OCR website at http://www.hhs.gov/ocr/privacy/hipaa/news/mghnews.html.
Additional information about OCR’s enforcement activities can be found at http://www.hhs.gov/ocr/privacy/hipaa/enforcement/examples/index.html.
Note: All HHS press releases, fact sheets and other press materials are available at http://www.hhs.gov/news.
HHS Press Office