Settlement Related to Theft of Mobile Device Further Highlights Need to Revisit Privacy and Security Policies and Procedures As the Audit Process Unfolds

As follow-up to our April 2016 Legal Alert, the need for health care providers to review their privacy and security programs cannot be overemphasized. Last week, Business Associate Catholic Health Care Services of the Archdiocese of Philadelphia (CHCS) agreed to settle potential violations of the Health Insurance Portability and Accountability Act (HIPAA) Security Rule after the theft of a CHCS mobile device allegedly compromised the protected health information (PHI) of 412 nursing home residents. CHCS provided management and information technology services as a Business Associate to six skilled nursing facilities. The settlement included a monetary payment of $650,000 and a corrective action plan, which included two years of monitoring. Read More