Resolution Agreement with Management Services Organization Washington, Inc. — Corrective action / RA

Full description

Navigate to: HIPAA for Professionals Regulatory Initiatives Privacy Summary of the Privacy Rule Guidance Combined Text of All Rules HIPAA Related Links Security Security Rule NPRM Summary of the Security Rule Security Guidance Cyber Security Guidance Breach Notification Breach Reporting Guidance Reports to Congress Regulation History Compliance & Enforcement Enforcement Rule Enforcement Process Enforcement Data Resolution Agreements Case Examples Audit Reports to Congress State Attorneys General Special Topics Parental Access Mental and Behavioral Health Change Healthcare Cybersecurity Incident FAQs HIPAA and COVID-19 HIPAA and Reproductive Health HIPAA and Final Rule Notice HIPAA and Telehealth HIPAA and FERPA Research Public Health Emergency Response Health Information Technology Health Apps Patient Safety Covered Entities & Business Associates Business Associate Contracts Business Associates Training & Resources FAQs for Professionals Other Administrative Simplification Rules Substance Use Disorder Confidentiality Resolution Agreement On December 13, 2010, the U.S. Department of Health & Human Services (HHS) entered into a Resolution Agreement with Management Services Organization Washington, Inc. (MSO), to settle potential violations of the Health Information Portability and Accountability Act Privacy and Security Rules. This settlement arose from and was made in coordination with the HHS Office of the Inspector General and the U.S. Department of Justice, which had been investigating MSO for violations of the Federal False Claims Act. In the agreement, MSO agrees to pay $35,000 and implement a detailed Corrective Action Plan (CAP) to ensure that it will appropriately safeguard identifiable electronic patient information against impermissible use or disclosure. The CAP includes requirements for MSO to develop, maintain, and revise its policies and procedures and to appropriately train its workforce on these policies and procedures. HHS will monitor MSO’s compliance with the terms of the CAP and the Privacy and Security Rules for two years. The Resolution Agreement and CAP relate to MSO’s disclosure of electronic protected health information to Washington Practice Management, LLC, owned by MSO, which used the information for marketing purposes. An HHS investigation showed that MSO intentionally did not have in place or implement appropriate and reasonable administrative, technical, and physical safeguards to protect the privacy of the protected health information. Read the Resolution Agreement and Corrective Action Plan Content last reviewed July 26, 2013