Health Law Update

Home | Health Law Update

<img class="wp-image-5589 alignright" src="https://dataprivacymonitor.bakerhostetlerblogs.com/wp-content/uploads/sites/5/2019/01/lock-paperwork-iStock-168325378_1200x630.jpg" alt="Secure and protected medical records. Bar code added to folder, not actual patient information. Concept image. Narrow depth of field." width="438" height="230" />

In December 2018, Pagosa Springs Medical Center settled potential Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security Rule violations and entered into a corrective action plan with the Office for Civil Rights (OCR) at the U.S. Department of Health &amp; Human Services. The incident involved a former employee who continued to have remote access to Pagosa Springs Medical Center’s web-based scheduling calendar for two months after the employee’s termination, which resulted in 557 individuals’ electronic protected health information (ePHI) being improperly disclosed. Additionally, there was no business associate agreement between Pagosa Springs Medical Center and Google, the web-based scheduling calendar vendor. Pagosa Springs Medical Center, an 11-bed critical access hospital located in rural Colorado, paid $111,400 and entered into a two-year corrective action plan. The corrective action plan includes updates to Pagosa Springs Medical Center’s HIPAA security management, business associate agreement, and policies and procedures, as well as training its workforce in these areas.

<a href="https://www.dataprivacymonitor.com/hipaahitech/provisioning-workforce-access-to-electronic-protected-health-information-it-may-be-common-sense-but-is-it-easy-to-implement/">Read more</a>.

Provisioning Workforce Access to Electronic Protected Health Information: It May Be ‘Common Sense,’ but Is It Easy to Implement?