Home » Cyber » What we can learn from MD Anderson's $4.3 million HIPAA penalty
What we can learn from MD Anderson's $4.3 million HIPAA penalty
June 27, 2018 Cathy Bryant
In what was the fourth largest settlement amount for HIPAA violations, the University of Texas MD Anderson Cancer Center was assessed $4.3 million in penalties for violating HIPAA. 1
Let's go behind the headlines and take a closer look at the case.
MD Anderson was investigated by the HHS Office for Civil Rights (OCR) after reporting three data breaches that occurred in 2012 and 2013. The breaches involved the theft of an unencrypted laptop and the loss of two unencrypted USB thumb drives that contained the electronic protected health information (ePHI) of more than 33,500 individuals. 1
Though MD Anderson had encryption policies in place since 2006, they did not adopt system-wide encryption until 2011. According to the OCR, MD Anderson also failed to encrypt its electronic devices from March 24, 2011 to January 25, 2013. 1
MD Anderson argued that it was not obligated to encrypt its devices, because the ePHI in question was for research, and was not subject to HIPAA requirements. MD Anderson also argued HIPAA's penalties were unreasonable. 1
"We are disappointed by the ALJ's ruling and we are concerned that key exhibits and arguments were not considered," MD Anderson officials said in a statement to the Houston Chronicle. 2
"In all three cases involving the loss or theft of devices reviewed by the Administrative Law Judge, there is no evidence any patient information was viewed or any harm to patients was caused," the statement continued.2
An administrative law judge agreed with the OCR's findings and upheld the $4,348,000 in penalties, based on each day of MD Anderson's noncompliance with HIPAA and for each record of individuals breached.
The judge said MD Anderson's "dilatory conduct is shocking given the high risk to its patients resulting from the unauthorized disclosure of ePHI." 1
MD Anderson says it plans to appeal the ruling. 2
Organizations should start with the basics, conduct a risk assessment (using an outside party if possible).
Develop a risk management plan based on the findings of the risk assessment.
All organizations must have written policies and procedures. If you purchase policy and procedure templates, make sure they reflect your actual processes and that you follow them.
If you have a breach, you should expect an OCR investigation. Cooperate with any investigation and respond to the OCR in a timely and complete manner.
Patients expect their data will be protected. A breach can have serious consequences to your organization from the cost of the breach, defense costs, loss of income, and reputational harm. Be proactive and prepared, including having adequate cyber risk transfer or cyber insurance. 1
Read more about the case here.
1. U.S. Department of Health and Human Services. Judge rules in favor of OCR and requires a Texas cancer center to pay $4.3 million in penalties for HIPAA violations. June 18, 2018. Available at https://www.hhs.gov/about/news/2018/06/18/judge-rules-in-favor-of-ocr-and-requires-texas-cancer-center-to-pay-4.3-million-in-penalties-for-hipaa-violations.html. Accessed June 27, 2018.
2. Deam J. MD Anderson to pay $4.3 million penalty for data breach. June 20, 2018. Available at https://www.chron.com/news/houston-texas/houston/article/MD-Anderson-to-pay-4-3-million-penalty-for-data-13007475.php . Accessed June 27, 2018.
Questions about HIPAA and cyber risk management? Visit our website or contact our team of cyber experts at consultingwebmail@tmlt.org or 800-580-8658.
Cathy joined TMLT in 2010 and serves as the Senior Compliance and Risk Management Manager. Cathy leads the development and implementation of TMLT's cyber risk management services. Cathy Bryant can be reached at cathy-bryant@tmlt.org.
Visit Website More Content by Cathy Bryant
Anthem pays $16 million HIPAA penalty
Anthem will pay $16 million after cyber attacks exposed the ePHI of 79 million people
Why the Facebook scandal should have you analyzing your third-party vendors
Podcast: Tech, Telemedicine, Tomorrow
Remote patient monitoring — Risk management considerations
Factors consider when using remote patient monitoring.
OCR warns of fraudulent postcard disguised as official OCR communication
The OCR has issued a warning about a false postcard notifying recipients of a mandatory HIPAA risk assessment.
Cyber criminal pretends to be OCR investigator to obtain PHI
The OCR is warning about an increase in malicious behavior by cyber criminals seeking access to protected health information.
Cyber insurance, Part 2: What are the potential costs of cyber risk?
In this webinar, TMLT's cyber insurance expert, John Southrey, discusses the total cost of cyber risks and how TMLT's cyber insurance can provide crucial financial risk transfer. The webinar is design
Cyber insurance, Part 1: Understanding your coverage
In this informative webinar, TMLT's cyber insurance expert, John Southrey, provides a comprehensive overview of the primary cyber insurance benefits endorsed to TMLT's medical professional liability i
An interview with cyber attorney, Adrian Senyszyn
In this webinar, cyber attorney Adrian Senyszyn addresses frequently asked questions about cyber security and current threats to practices, HIPAA compliance, and breach investigations. Watch this CME
The Reporter Cyber Edition 2020
Cyber criminals hijack video calls; FBI provides recommendations
Our increased dependency on teleconferencing has created new opportunities and incentives for cyber criminals to hack into video calls.
Coronavirus: Answers to your risk management questions
On-demand webinar discussing: HIPAA and patient privacy; sharing PHI with public health authorities; and preparing for coronavirus in your practice.
Podcast: Tips, trends, and understanding your cyber insurance
Learn about the current cyber security landscape, what your cyber insurance policy should cover, and more.
Cyber fraud case study: Failure to recognize phishing email
The hospital received an email invoice from the ED group with instructions to send payment to a new account.
OCR to waive potential HIPAA penalties during COVID-19 emergency
HHS OCR announced it will waive potential HIPAA penalties against health care providers using telehealth services to care for patients during the COVID-19 national emergency.
HIPAA and the coronavirus
HIPAA and public health emergencies: updates from the OCR
What are some of the direct and indirect costs of a data breach?
John Southrey, director of consulting services at TMLT, describes the costs - both direct and indirect - of a cyber data breach.
What is covered under "cyber extortion" within a cyber liability policy?
John Southrey, director of consulting services at TMLT, describes cyber extortion threats, like ransomware, and what to do if you receive this kind of threat.
48 hours after a HIPAA breach
The actions taken in the hours and days after a cyber breach are critical, especially in protecting evidence. In this webinar, attorney Adrian Senyszyn, discusses the most important steps that covered
Preserving evidence Is vital in a ransomware attack
Providers can take steps following an attack to help preserve evidence, which may help them meet their burden of proof and conclude that there was a low probability of compromise to ePHI.
Study shows increased cyber security can affect patient outcomes
Corrective actions taken to enhance privacy and security may introduce usability issues.
Can physicians use their own mobile devices at work?
Cathy Bryant, manager of product development & consulting services at TMLT, discusses the pros and cons of "BYOD," or "Bring Your Own Device."
A group admin explains what business interruption really means
What happens when a system failure brings down the EMR?