A Cape Canaveral, Fla.-based medical services contractor recently agreed to pay nearly $1 million to settle the Justice Department's first civil cyberfraud initiative case.
Comprehensive Health Services is paying a $930,000 settlement to resolve allegations it violated the False Claims Act, according to a March 8 Justice Department news release.
The company was contracted to provide medical support services at State Department and Air Force facilities in Iraq and Afghanistan.
Comprehensive Health Services submitted claims to the State Department for the cost of a secure EHR to store all patients' medical records. Those records included the confidential identifying information of U.S. service members, diplomats, officials and contractors working and receiving medical care in Iraq.
The Justice Department alleged that, between 2012 and 2019, the company did not disclose that it had not consistently stored patients' medical records on a secure EHR system. When company staff scanned medical records for the EHR system, they left scanned copies of some records on an internal network drive accessible to nonclinical staff. The company allegedly did not take adequate steps to store the information even after staff raised privacy concerns.
The civil cyberraud initiative launched in October 2021 to pursue cybersecurity-related fraud by government contractors and grant recipients.