Printer Friendly, PDF & Email

$3 Million Settlement Demonstrates Need for Quick Breach Management

From the government’s telling, the new $3 million settlement between the HHS Office for Civil Rights (OCR) and Touchstone Medical Imaging LLC of Franklin, Tennessee, sounds like a lesson in what not to do if you have a HIPAA breach.

In short, you keep digging when you learn there might be a breach, and you’d better have your house in order if it turns out to be a reportable one.

The settlement, announced May 6, could be the last of the big-dollar agreements; it was signed in early April, just weeks before OCR Director Roger Severino announced that, effective immediately, the agency was shaving its annual maximum penalties (“Easy Win for MD Anderson? OCR Drops Annual Caps, Issues Warning on Right-of-Access Denials,” RPP 19, no. 5).

Then again, OCR is maintaining the highest level of $1.5 million per year (per identical violation when due to willful neglect not corrected within 30 days), which perhaps is apt in this instance.

The Touchstone settlement is the first OCR signed this year. It ended 2018 with a total of $28.7 million in penalties imposed or agreed to (but not collected), a record (“OCR Piggybacks on Another Calif. Settlement, Adds $3M From Cottage Health to 2018 Total,” RPP 19, no. 3).

This document is only available to subscribers. Please log in or purchase access.

Would you like to read this entire article?

If you already subscribe to this publication, just log in. If not, let us send you an email with a link that will allow you to read the entire article for free. Just complete the following form.

* required field