Enforcement Firsts: Presence Health Fined $475,000 for Taking Too Long to Report HIPAA Breach

Patient health information breaches—whether from hacking, glitches or just plain old carelessness—remain an all too common occurrence in labs and other health care institutions. A new HIPAA rule took effect in 2013, requiring providers to furnish timely notification of such breaches. And on Jan. 3, a large Illinois health system named Presence Health became the first provider penalized for failing to meet those notification requirements.

The Rule
Under the HIPAA rule, providers must furnish notification of breaches to three sets of recipients:

1. The HHS Office for Civil Rights (OCR);

2. The individuals affected by the breach; and

3. The media (if the breach affects 500 or more individuals).

The deadline for notification: within 60 days of discovering the breach.

What Happened
On Oct. 22, 2013, Presence discovered that paper-based OR schedules for one of its surgery centers had been removed from the files. The missing records listed personal health information of 836 individuals, including names, birth dates, medical record numbers, dates and types of procedures received and anesthesia administered.

It was a breach requiring notification under the HIPAA rule. The good news is that Presence did send out all of the required notices. The bad news is that it do so only well after the 60-day deadline had expired:

The Case
The OCR charged Presence with a separate HIPAA violation for each one of the notices that was late (as well as additional violations committed later on that were discovered during the investigation). Faced with potential liability in the millions, Presence decided to settle the claims. The price tag: $475,000 and the promise to adopt a Corrective Action Plan (CAP) implementing measures to prevent future violations.

Takeaway: Based on the settlement agreement, it appears that Presence understood and made earnest efforts to comply with its breach notification obligations. Unfortunately, it took too long to do so. Although it is not clear why the notices were late, what can be said with confidence is that implementing clear and specific rules and timetables for responding to and reporting data breaches is crucial to ensure compliance with HIPAA breach notification requirements.