A Minnesota hospital system has agreed to pay $1.55 million to settle allegations that it violated the privacy and security rules of the Health Insurance Portability and Accountability Act (HIPAA) of 1996.
The issue involved North Memorial Health Care System dealing with its billing partner, hospital revenue cycle management company Accretive Health, without a business associate agreement in place.
North Memorial has given Accretive access to the hospital database, which stored electronic protected health information of 289,904 patients.
The hospital system also violated the HIPAA for its supposed failure to perform an organization-wide risk analysis to address the risks and vulnerabilities to its patient information.
“Two major cornerstones of the HIPAA Rules were overlooked by this entity,” said Jocelyn Samuels, director of the US Department of Health and Human Services Office for Civil Rights (OCR).
“Organizations must have in place compliant business associate agreements as well as an accurate and thorough risk analysis that addresses their enterprise-wide IT infrastructure,” she added.
North Memorial’s alleged violations of the HIPAA were made known following a breach report in September 2011, which indicated that an unencrypted, password-protected laptop was stolen from an Accretive employee, affecting the electronic protected health information of 9,497 individuals.
Apart from the payout, North Memorial will also resolve the allegations by developing a system-wide risk analysis and risk management plan, as required by the HIPAA.
North Memorial shall also train personnel on all policies and procedures that will be developed or revised pursuant to a risk management plan.
