You’ve seen hundreds of companies selling HIPAA products. There are HIPAA training videos, policy templates, consultants, HIPAA books, HIPAA coffee mugs and the list goes on and on. And yet “become HIPAA compliant” is still on your long list of things to do. Have you asked yourself why you never seem to get to “become...
We have written about the HIPAA fine and reputation damage to Phoenix Cardiac Surgery. Phoenix Cardiac Surgery is a small 5 physician specialist in Phoenix, AZ. Let’s quickly review why the Office of Civil Rights fined Phoenix Cardiac Surgery $100,000. Lack of HIPAA Policies and Procedures Lack of HIPAA training for all workforce members Lack...
The Phoenix Cardiac Surgery medical practice was handed a $100,000 fine for failing to protect patient information. The resulting resolution agreement from the Office of Civil Rights (OCR) is very interesting. Let’s take a look at is. The full resolution agreement can be found here (PDF). Lack of training for employees (a) From April 14,...
There has been a lot written recently about organizations that have received high profile HIPAA fines from the Office of Civil Rights (OCR). The Tennessee Blue Cross Blue Shield was handed a $1.5 million fine, Cignet Health was given a $4.3 million fine and Massachusetts General Hospital was awarded a $1 million fine. The only...
In the Ponemon 2011 Cost of Data Breach Study, 41% of breaches were due to third party mistakes. Take a step back and think about the impact of that number. The use of third party organizations are more and more common. According to the HHS.gov website, some examples of third party / business associates include:...
The annual Ponemon 2011 Cost of Data Breach Study has been released and it gives very good insight. The study looks at various costs of data breaches across industries such as media, retail, financial, healthcare and pharmaceutical. Let’s focus in on the costs of data breaches in the healthcare industry. Overall the average cost of...
Part of the proposed requirements for Meaningful Use Stage 2 addresses encrypting data at rest. Let’s take a look at the exact wording conduct or review a security risk analysis in according with the requirements under 45 CFR 164.308(a)(1), including addressing the encryption/security of data at rest in accordance with requirements under 45 CFR 164.312(a)(2)(iv)...
Many people ask us what is needed for an Incident Response Plan (IRP). It seems to be one of the HIPAA requirements that people have a hard time putting their arms around. So let’s take a practical look at what is needed. Incidents will happen The first thing that must be accepted and understood is...
The Office of Civil Rights (OCR) has released a series of videos to help practices and medical professionals understand the HIPAA regulations. Unfortunately as of today it is not a very well-known resource, each of the 4 videos has less than 75 views. Hopefully with more awareness of this resource, more people will watch the...
In an interview with Howard Anderson over at healthcareinfosecurity.com, OCR’s Leon Rodriguez gives some interesting insight into OCR’s audit program. Some are some highlights of the interview: Due to funding cuts and capacity of KPMG, the firm hired to conduct the audits, the agency may come up short of the 150 planned audits OCR funding...
© 2026 · HIPAA Secure Now!
Recent Comments