A settlement agreement with Pagosa Springs (Colo.) Medical Center that the Department of Health and Human Services’ Office for Civil Rights announced this week highlights important, but perhaps sometimes overlooked, privacy and security risk issues associated with access to electronic protected health information. The settlement resolves a complaint alleging that the hospital impermissibly disclosed electronic PHI to a former employee, and to a web-based scheduling calendar vendor without a business associate agreement in place. Pagosa Springs, a critical access hospital, agreed to pay $111,400 and adopt a corrective action plan to settle these potential violations of the Health Insurance Portability and Accountability Act privacy and security rules. “Covered entities that do not have or follow procedures to terminate information access privileges upon employee separation risk a HIPAA enforcement action,” OCR said. “Covered entities must also evaluate relationships with vendors to ensure that business associate agreements are in place with all business associates before disclosing protected health information.”

Related News Articles

Headline
Last week, Microsoft released security updates to fix a critical vulnerability in older versions of its Windows operating system.
Headline
President Trump yesterday signed an executive order to help strengthen the nation’s cybersecurity workforce.
Headline
The Department of Health and Human Services Friday issued a notice reducing the maximum civil monetary penalty for all but the most serious violations of the…
Headline
Reps. Earl Blumenauer, D-Ore., and Markwayne Mullin, R-Okla., yesterday reintroduced  the Overdose Prevention and Patient Safety Act (H.R. 2062), AHA-supported…
Headline
In a letter today to Sen. Mark Warner, D-Va., AHA responds to a recent request from the senator for input regarding cybersecurity in the health care sector.
Headline
The AHA today voiced support for the Centers for Medicare…