The Feinstein Institute for Medical Research has agreed to settle potential HIPAA violations with a $3.9 million payment and a substantial corrective action plan.
Feinstein is a biomedical research institute based in Manhasset, N.Y., that falls under the Great Neck, N.Y.-based Northwell Health enterprise. In 2012, Feinstein reported a data breach after a computer containing the electronic protected health information of nearly 13,000 patients and research participants was stolen from an employee's car. Information stored on the laptop included names, birth dates, addresses, Social Security numbers, diagnoses, laboratory results, medications and other medical information.
HHS' Office of Civil Rights launched an investigation into the breach and determined Feinstein's security management processes to be incomplete and insufficient to address potential risks and vulnerabilities of electronic PHI, including failure to restrict access to unauthorized users and a lack of policies and procedures to govern the removal of laptops out of its facilities.
"Research institutions subject to HIPAA must be held to the same compliance standards as all other HIPAA-covered entities," said OCR Director Jocelyn Samuels. "For individuals to trust in the research process and for patients to trust in those institutions, they must have some assurance that their information is kept private and secure."
More articles on HIPAA:
North Memorial Health Care to pay $1.55M HIPAA settlement: 5 things to know
Bipartisan group of legislators accuses HHS of lagging on HIPAA technical guidance
HIPAA awareness & compliance in 2014 vs. 2016: 6 key survey findings