The University of Massachusetts Amherst agreed to pay $650,000 to settle allegations it violated HIPAA provisions resulting from a malware infection in 2013.
On June 18, 2013, UMass reported a workstation in its center for language, speech and hearing was infected with a malware program, compromising the privacy of 1,670 patients. Names, addresses, social security numbers, dates of birth, health insurance information and diagnoses and procedures codes were potentially disclosed.
In addition to the monetary settlement, UMass officials agreed to a corrective action plan which requires the organization conduct an enterprisewide risk analysis to guard against future threats.