June 15, 2023
The United States Department of Health and Human Services Office for Civil Rights (OCR) recently struck a settlement with Yakima Valley Memorial Hospital, a general hospital based in Yakima, Washington.
An investigation under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) was centered on claims that a group of security guards assigned to the hospital’s ER department had accessed the medical records of 419 patients without due authorization.
Table of Contents
HIPAA Investigation Settlement and Alleged Unauthorized Access to Medical Records
The HIPAA Privacy, Security, and Breach Notification Rules guidelines have a broad reach, impacting numerous healthcare organizations. These regulations lay forth necessary standards that HIPAA-regulated organizations must follow, including securing patient details from unauthorized access.
Yakima Valley Memorial Hospital has resolved the unauthorized access to medical records issue on its own initiative. The hospital agreed to pay a total of $240,000 in settlement. To further avoid future security lapses or unauthorized access to protected health information (PHI), they have also agreed to implement revised rules and processes and educate those staff who will be tasked with handling them.
Yakima Valley Memorial Hospital and the HIPAA Investigation
It was back in May 2018 that the OCR began investigating the hospital about the said allegation. It all started when they received a breach notification report highlighting the concerning issue. It turns out that 23 security guards employed in the hospital’s emergency department were using their login credentials to access patient medical records stored in the electronic medical record system. The troubling part was that they had no valid job-related reason to do so. The accessed information encompassed crucial details like names, dates of birth, medical record numbers, addresses, treatment-related notes, and insurance information.
OCR Director Melanie Fontes Rainer emphasized that the healthcare industry frequently faces data breaches resulting from current and former workforce members inappropriately accessing patient records. She highlighted the importance for healthcare organizations to establish strict controls that limit workforce members from accessing information beyond their scope of job responsibilities. Rainer also stressed that HIPAA-covered entities must have extensive policies and procedures in place to safeguard PHI effectively and prevent instances of identity theft and fraud.
Settlement Details: Voluntary Resolution and Monetary Penalty
Aside from the $240,000 fine, the OCR will conduct a two-year monitoring period for Yakima Valley Memorial Hospital as part of a settlement agreement. Their compliance with the HIPAA Security Rule is to be ensured by this oversight. Also, Yakima Valley Memorial Hospital will implement several steps as part of its dedication to compliance, including carrying out a careful risk analysis to find any possible weak points in how they handle electronically protected health information (ePHI).
Additionally, a risk management strategy will be created and implemented to address and minimize the risks of the security threats found. The hospital will also enhance its existing HIPAA and Security Training programs and educate its workforce on the updated policies and procedures.
In addition, Yakima Valley Memorial Hospital will review its relationships with vendors and third-party service providers to identify business associates and establish appropriate business associate agreements if needed.
Corrective Action Plan
A Corrective Action Plan for hospitals should include the following to protect patient privacy and prevent unauthorized access to PHI:
- Thorough risk analysis: Yakima Valley Memorial Hospital must commit to conducting a comprehensive and meticulous risk analysis to identify potential vulnerabilities in its management of electronic PHI. This analysis will provide valuable insights into existing risks and enable the development of targeted mitigation strategies.
- Risk management plan: Building upon the risk analysis findings, Yakima Valley Memorial Hospital must develop and implement a robust risk management plan. This plan will address and mitigate identified security risks, ensuring a proactive and systematic approach to safeguarding PHI.
- Written policies and procedures: The hospital acknowledges the significance of well-defined, up-to-date policies and procedures. As part of this, Yakima Valley Memorial Hospital must enhance its existing set of HIPAA policies and procedures. It is also imperative for these documents to be regularly reviewed, maintained, and revised to reflect the ever-evolving best practices and regulatory requirements.
- Workforce training program: Recognizing the vital role of its workforce in protecting PHI, Yakima Valley Memorial Hospital may also enhance its HIPAA and Security Training Program. This program will provide comprehensive training to all staff members, equipping them with the knowledge and skills needed to adhere to the updated policies and procedures.
- Vendor and third-party relationships: To ensure the utmost protection of PHI, Yakima Valley Memorial Hospital must thoroughly review its relationships with vendors and third-party service providers. This review aims to identify any business associates and establish appropriate business associate agreements, if not already in place. The hospital must enforce data security standards and regulatory compliance among its partners through these agreements.
Through these proactive measures, Yakima Valley Memorial Hospital can establish itself as a leader in data security and reaffirm its dedication to the highest standards of healthcare information protection.
