HHS settles HIPAA case with BCBST for $1.5 million — $1,500,000

Full description

Navigate to: HIPAA for Professionals Regulatory Initiatives Privacy Summary of the Privacy Rule Guidance Combined Text of All Rules HIPAA Related Links Security Security Rule NPRM Summary of the Security Rule Security Guidance Cyber Security Guidance Breach Notification Breach Reporting Guidance Reports to Congress Regulation History Compliance & Enforcement Enforcement Rule Enforcement Process Enforcement Data Resolution Agreements Case Examples Audit Reports to Congress State Attorneys General Special Topics Parental Access Mental and Behavioral Health Change Healthcare Cybersecurity Incident FAQs HIPAA and COVID-19 HIPAA and Reproductive Health HIPAA and Final Rule Notice HIPAA and Telehealth HIPAA and FERPA Research Public Health Emergency Response Health Information Technology Health Apps Patient Safety Covered Entities & Business Associates Business Associate Contracts Business Associates Training & Resources FAQs for Professionals Other Administrative Simplification Rules Substance Use Disorder Confidentiality HHS settles HIPAA case with BCBST for $1.5 million On March 9, 2012, Blue Cross Blue Shield of Tennessee (BCBST) agreed to pay $1,500,000 to settle potential violations of the HIPAA Privacy and Security Rules. BCBST also agreed to a corrective action plan which includes: reviewing, revising, and maintaining its Privacy and Security policies and procedures; conducting regular and robust trainings for all BCBST employees covering employee responsibilities under HIPAA; and performing monitor reviews to ensure BCBST compliance with the plan. The investigation followed a notice submitted by BCBST to HHS in which it was reported that 57 unencrypted computer hard drives containing PHI of over 1 million individuals had been stolen from a leased facility in Tennessee. The enforcement action is the first resulting from a breach report required by the Health Information Technology for Economic and Clinical Health (HITECH) Act Breach Notification Rule.Read the Resolution Agreement and CAPFor Information on OCR’s Enforcement ActivitiesRead the HHS Press ReleaseTo File a Health Information Privacy or Security Complaint Content last reviewed June 7, 2017