The Health and Human Services Office for Civil Rights assessed a $239,800 civil penalty against a home-health care provider for HIPAA violations. The provider challenged the penalty, which was upheld by an administrative law judge. OCR has issued only two penalty assessments, as most HIPAA violations are resolved by a settlement agreement.
The HHS investigation stemmed from complaints of documents with PHI being left in the open and accessible to unauthorized individuals. HHS determined the provider did not have policies and procedures to protect PHI that was taken off site, and allowed home health care workers to maintain patient files personally and unprotected. After contacting the provider, the provider did not take sufficient steps to change its processes or put enhanced procedures in place. Therefore, HHS imposed penalties.
Upon appeal, the administrative law judge agreed that the provider violated HIPAA and upheld the penalty assessment.