Health Law Update

Home | Health Law Update

In its third resolution agreement of 2013, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) <a href="http://www.hhs.gov/news/press/2013pres/07/20130711b.html">recently announced</a> a $1.7 million <a href="http://www.hhs.gov/ocr/privacy/hipaa/enforcement/examples/wellpoint-agreement.html">resolution agreement</a> with WellPoint, Inc., a health insurer and managed care company. The resolution agreement stems from WellPoint's June 18, 2010, report to OCR regarding security weaknesses in an online application database which left the electronic protected health information (ePHI) of 612,402 individuals accessible to unauthorized individuals over the Internet for almost five months between 2009 and 2010. Information accessible included names, dates of birth, social security numbers, telephone numbers and health information.

In response to WellPoint's report, OCR initiated its investigation into WellPoint's compliance with the Privacy, Security, and Breach Notification Rules on September 9, 2010. OCR's investigation indicated the following:
<ul>
	<li>Contrary to its obligations under the Security Rule, WellPoint failed to adequately implement policies and procedures for authorizing access to ePHI maintained in its web-based application database;</li>
	<li>WellPoint failed to perform an adequate technical evaluation to ensure that safeguards were in place to meet requirements of the Security Rule for an operational change -- a software upgrade -- which would affect the security of ePHI maintained in its web-based application database;</li>
	<li>Between October 23, 2009, until March 7, 2010, WellPoint failed to adequately implement technology to verify persons or entities seeking access to ePHI maintained in its web-based application database; and</li>
	<li>During the same period of time, WellPoint impermissibly disclosed the ePHI of approximately 612,000 individuals maintained in its web-based application database.</li>
</ul>
Directly addressed in HHS's press release regarding the WellPoint settlement, HHS instructs covered entities and their business associates to have in place reasonable and appropriate technical, administrative and physical safeguards to protect the confidentiality, integrity and availability of ePHI. As previously discussed on the <a href="http://www.dataprivacymonitor.com/hipaahitech/what-covered-entities-and-business-associates-need-to-do-to-prepare-for-the-new-hipaahitech-requirem-1/">Data Privacy Monitor</a>, beginning September 23, 2013, liability for HIPAA violations will extend directly to business associates that receive or store PHI.

HHS OCR Sends Message to CEs and Their BAs: Protect ePHI Accessible Over the Internet