Maybe old breaches never die; they just come back to haunt you through belated enforcement actions by the federal government. That could be the story of Banner Health Systems of Arizona, which recently paid the HHS Office for Civil Rights (OCR) $1.25 million for a 2016 hacking of its payment information systems that affected several million people.[1] It also agreed to implement a two-year corrective action plan (CAP).
Signed in December but disclosed in February, OCR’s settlement comes three years after Banner agreed to pay up to $8.9 million to end a class-action suit stemming from the same breach; under the terms of that agreement, it also was required to implement new security measures to better protect its data.
OCR settlements and class-action suits often go hand in hand. But the new OCR settlement also makes Banner part of a much rarer phenomena: covered entities subject to two HIPAA settlements with CAPs. In Banner’s case, it may be the only one with little time between when the first CAP ends and the second one begins.
If they’ve stayed on schedule, Banner officials are just finishing implementing measures and filing reports imposed as part of an earlier two-year CAP and $200,000 settlement triggered by complaints from two patients who didn’t get access to their records for six months or more.
At the time, Banner’s January 2021 settlement was OCR’s 14th in its Right of Access Initiative, which penalizes organizations for failing to provide patients their records or those of family members within the required time frame or for charging more than is allowed.[2] To date, there have been 43 total; the most recent was announced Jan. 23.
