Chicago-based Presence Health agreed to implement a corrective action play and pay $475,000 to HHS' Office for Civil Rights to settle claims that the health system violated HIPAA.
This is the first HIPAA settlement based on a health system's untimely reporting of a breach of unsecured patient information.
On Oct. 22, 2013, the health system discovered operating room schedules were missing from the Presence Surgery Center at Joliet, Ill.-based Presence St. Joseph Medical Center. The schedules contained the personal information of 836 patients, including names, birthdates, medical record numbers, dates and types of procedures, surgeon names and types of anesthesia.
The OCR received a breach notification report from Presence Health on Jan. 31, 2014. After investigating the incident, the OCR deduced that the health system failed to notify affected patients, social media outlets and the OCR of the breach within 60 days of discovering it.
"Covered entities need to have a clear policy and procedures in place to respond to the Breach Notification Rule's timeliness requirements," said OCR Director Jocelyn Samuels. "Individuals need prompt notice of a breach of their unsecured PHI so they can take action that could help mitigate any potential harm caused by the breach."
When contacted for comment, a Presence Health spokesperson issued the following comment to Becker's Hospital Review: "Because patient privacy is a top priority at Presence Health, we are working diligently with the OCR on all steps required under the corrective action plan, including additional associate training in HIPAA policies and procedures. This is the culmination of a several year process working with the OCR to resolve a matter we voluntarily reported to the OCR in 2014 related to an isolated incident involving paper records at a surgery center located in Joliet, Ill. This incident did not involve any electronic records and did not involve any disclosure of patient contact or financial information. We are confident that reports on our progress to quickly implement revised policies and procedures will be positive."