Under a settlement with the U.S. Department of Health and
Human Services (HHS), Affinity Health Plan, Inc. will settle potential
violations of the Health Insurance Portability and Accountability Act of 1996
(HIPAA) Privacy and Security Rules for $1,215,780. Affinity Health Plan
is a not-for-profit managed care plan serving the New York metropolitan area.
Affinity filed a breach report with the HHS Office for Civil
Rights (OCR) on April 15, 2010, as required by the Health Information
Technology for Economic and Clinical Health, or HITECH Act. The HITECH Breach
Notification Rule requires HIPAA-covered entities to notify HHS of a breach of
unsecured protected health information. Affinity indicated that it was
informed by a representative of CBS Evening News that, as part of an
investigatory report, CBS had purchased a photocopier previously leased by
Affinity. CBS informed Affinity that the copier that Affinity had used
contained confidential medical information on the hard drive.
Affinity estimated that up to 344,579 individuals may have
been affected by this breach. OCR’s investigation indicated that Affinity
impermissibly disclosed the protected health information of these affected
individuals when it returned multiple photocopiers to leasing agents without
erasing the data contained on the copier hard drives. In addition, the
investigation revealed that Affinity failed to incorporate the electronic
protected health information (ePHI) stored on photocopier hard drives in its
analysis of risks and vulnerabilities as required by the Security Rule, and
failed to implement policies and procedures when returning the photocopiers to
its leasing agents.
"This settlement illustrates an important reminder
about equipment designed to retain electronic information: Make sure that all
personal information is wiped from hardware before it’s recycled, thrown away
or sent back to a leasing agent," said OCR Director Leon Rodriguez.
“HIPAA covered entities are required to undertake a careful risk analysis to
understand the threats and vulnerabilities to individuals’ data, and have
appropriate safeguards in place to protect this information.”
In addition to the $1,215,780 payment, the settlement
includes a corrective action plan requiring Affinity to use its best efforts to
retrieve all hard drives that were contained on photocopiers previously leased
by the plan that remain in the possession of the leasing agent, and to take
certain measures to safeguard all ePHI.
For more information on safeguarding sensitive data stored
in the hard drives of digital copiers: http://business.ftc.gov/documents/bus43-copier-data-security.
The National Institute of Standards and Technology has issued guidance on media
sanitation: http://csrc.nist.gov/publications/drafts/800-88-rev1/sp800_88_r1_draft.pdf.
OCR offers free training on compliance with the HIPAA Privacy and Security Rules
for continuing medical education credit athttp://www.medscape.org/sites/advances/patients-rights.
The HHS Resolution Agreement and CAP can be found on the OCR
website athttp://www.hhs.gov/ocr/privacy/hipaa/enforcement/examples/affinity-agreement.html
HHS settles with health plan in photocopier breach case
