Federal regulators are allowing cyber insurer Beazley Group to cover a $2.3 million HIPAA fine on behalf of its bankrupt client, 21st Century Oncology, according to Healthcare Info Security.
Earlier this month, the Fort Myers, Fla.-based company agreed to pay HHS' Office for Civil Rights a $2.3 million settlement to resolve issues related to a 2015 data breach that affected 2.2 million patient records. Separately, it reached a $26 million settlement, resolving false claims allegations and a self-disclosure that it submitted false attestations regarding the use of EHR software.
However, in May, 21st Century Oncology filed for Chapter 11 bankruptcy.
OCR has repeatedly said that it doesn't wish to put organizations out of business when issuing these fines, but privacy attorney Adam Greene of law firm Davis Wright Tremaine, who was not involved in the case, told Healthcare Info Security that "when things might be tough financially, OCR clearly still expects the organization to put significant resources into privacy and security."
"This is the first time that I have seen OCR enter into a settlement with an organization that had declared bankruptcy at the time of settlement," Mr. Greene told Healthcare Info Security. "As is increasingly the case, the covered entity was covered by cyber insurance … Normally, the covered entity would pay the settlement or fine and would get reimbursed by the insurer. Here, OCR is going directly to the insurer to receive the payment, which is likely in large part because the covered entity is in bankruptcy proceedings."
A Beazley spokeswoman told Healthcare Info Security the company doesn't comment on client-related matters, but in general, its breach response coverage and information security liability policies include regulatory defense and penalties.
More articles on cybersecurity:
84k patient records exposed in November: 6 things to know
NYU Langone Health notifies 2k after binder containing patient data improperly disposed
Bitcoin falls $1k in 1 hour as Bitcoin Cash emerges as rival: 4 things to know