Data Breach Results in $4.8 Million HIPAA Settlements: $4,800,000
Resolution May 2014
Penalty
$4,800,000
Action type
Settlement
Entity profile
—
Case number
—
What went wrong
Data Breach Results in $4.8 Million HIPAA Settlements - May 7, 2014
- Navigate to: HIPAA for Professionals Regulatory Initiatives Privacy Summary of the Privacy Rule Guidance Combined Text of All Rules HIPAA Related Links Security Security Rule NPRM Summary of the Security Rule Security Guidance Cyber Security Guidance Breach Notification Breach Reporting Guidance Reports to Congress Regulation History Compliance & Enforcement Enforcement Rule Enforcement Process En
Full description
Navigate to: HIPAA for Professionals Regulatory Initiatives Privacy Summary of the Privacy Rule Guidance Combined Text of All Rules HIPAA Related Links Security Security Rule NPRM Summary of the Security Rule Security Guidance Cyber Security Guidance Breach Notification Breach Reporting Guidance Reports to Congress Regulation History Compliance & Enforcement Enforcement Rule Enforcement Process Enforcement Data Resolution Agreements Case Examples Audit Reports to Congress State Attorneys General Special Topics Parental Access Mental and Behavioral Health Change Healthcare Cybersecurity Incident FAQs HIPAA and COVID-19 HIPAA and Reproductive Health HIPAA and Final Rule Notice HIPAA and Telehealth HIPAA and FERPA Research Public Health Emergency Response Health Information Technology Health Apps Patient Safety Covered Entities & Business Associates Business Associate Contracts Business Associates Training & Resources FAQs for Professionals Other Administrative Simplification Rules Substance Use Disorder Confidentiality Data Breach Results in $4.8 Million HIPAA Settlements New York and Presbyterian HospitalNew York and Presbyterian Hospital (NYP) has agreed to pay OCR $3,300,000 to settle potential violations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy and Security Rules, and will adopt a corrective action plan to evidence their remediation of these findings.Read the Resolution AgreementHHS Press Release Columbia UniversityColumbia University (CU) has agreed to settle potential violations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy and Security Rules, including a $1,500,000 monetary settlement and corrective action plan to address deficiencies in its HIPAA compliance program.Read the Resolution AgreementHHS Press Release Content last reviewed June 7, 2017
Timeline
- ResolutionMay 2014
- Incident and investigation milestones are not consistently published by OCR in machine-readable form.
Key takeaways for your organization
- Treat internet-facing systems and vendor-hosted environments as in-scope for HIPAA risk analysis and technical safeguards testing.
- Maintain an actionable risk analysis tied to remediation milestones; evidence should map to Security Rule implementation specifications.
- Align policies, procedures, and evidence with the specific CFR provisions cited in OCR resolutions affecting your entity type.
- Run tabletop exercises for breach response, OCR inquiry handling, and privilege-preserving communications with counsel.
Related actions
Health Care Provider Pays $100,000 Settlement to OCR for Failing to Implement HIPAA Security Rule Requirements
—
$100,000
Lab Pays $16,500 Settlement to HHS, Resolving Potential HIPAA Violation over Medical Records Request
GA
$16,500
HHS Civil Rights Office Resolves HIPAA Right of Access Investigation with $20,000 Settlement
FL
$20,000
Source
U.S. Department of Health and Human Services release
Source: U.S. Department of Health and Human Services, Office for Civil Rights. medcomply.ai aggregates public materials for educational use, not legal advice.