Five Years After ‘a Singular Human Error,’ Two Breach Notices, Revenue Firm Settles With OCR

By Theresa Defino

As far as settlements for alleged HIPAA violations go, a recent agreement announced by the HHS Office for Civil Rights (OCR) doesn’t immediately jump out as particularly noteworthy. The amount paid by the practice management and IT firm—$350,000—is a far cry from the millions OCR used to command in such cases, and the number of patient records wasn’t in the millions, either.

But most compliance officials know they should review all OCR’s enforcement actions for insights. And when they dive into the agreement Matt Rolfes, president and CEO of MedEvolve Inc., signed with OCR in March, they’ll discover a slightly more complicated story than just protected health information (PHI) left unguarded on a server for perhaps four months. The case demonstrates that—at least in the eyes of OCR—an organization can make an error when it concludes an incident isn’t a breach.

The settlement documents reveal that OCR disagreed with MedEvolve’s assessment of the number of records affected in June 2018 and required the Arkansas firm to make another public breach notification two years later.

“After five years, we are glad to have concluded the settlement,” Rolfes said in an email in response to RPP’s questions. “We look forward to moving beyond the incident with a bright future, creating new opportunities in healthcare, and helping healthcare organizations improve margin to further their missions.”

MedEvolve’s was the second settlement OCR announced in May. A Pittsburgh, therapist agreed to pay $15,000 as part of OCR’s 44th records access initiative.[1]

MedEvolve, founded in 1998, provides revenue cycle management and other services. Under HIPAA, it is a business associate (BA), not a covered entity (CE). According to information MedEvolve released on July 10, 2018, the firm experienced a breach of PHI belonging to Premier Immediate Medical Care. At the time, MedEvolve said it “discovered that an FTP [file transfer protocol] containing a file with information related to certain Premier patients was inadvertently accessible to the internet.“[2]

The firm’s “investigation determined that the file was internet accessible from March 29, 2018, to May 4, 2018. The investigation also determined that one file was subject to unauthorized access on March 29, 2018,” MedEvolve said. However, in its settlement documents, OCR listed a far longer period of public accessibility.

This document is only available to subscribers. Please log in or purchase access.
Purchase Login
 


Would you like to read this entire article?

If you already subscribe to this publication, just log in. If not, let us send you an email with a link that will allow you to read the entire article for free. Just complete the following form.

* required field

First name field cannot be blank!
Last name field cannot be blank!
We will send you an email that will give you access to this entire article.
Email field cannot be blank!
Enter a valid email!
Company field cannot be blank!
Enter a valid company!
Title field cannot be blank!

We're committed to your privacy. The Society of Corporate Compliance and Ethics (SCCE) & Health Care Compliance Association (HCCA) uses the information you provide us to contact you about our relevant content, products, and services. For more information, check out our Privacy Policy.


About SCCE

The Society of Corporate Compliance and Ethics (SCCE) is a non-profit, member-based professional association. SCCE supports our members' work with education, news, and discussion forums. We are a community of leaders, defining and shaping the corporate compliance environment across a wide range of industries and geographic regions. In developing and maintaining effective ethics and compliance programs, our members strengthen and protect their companies.

952.933.4977

About HCCA

The Health Care Compliance Association (HCCA), is a 501(c)6 non-profit, member-based professional association. HCCA was established in 1996 and is headquartered in Minneapolis, MN. We provide training, certification, and other resources to over 10,000 members. Our members include compliance officers and staff from a wide range of organizations, including hospitals, research facilities, clinics and technology service providers.

952.988.0141

Facebook Twitter LinkedIn
Copyright © 2024 by Society of Corporate Compliance and Ethics (SCCE) & Health Care Compliance Association (HCCA). No claim to original US Government works. All rights reserved. All information provided through this site, including without limitation all information such as the “look and feel” of the site, data files, graphics, text, photographs, drawings, logos, images, sounds, music, video or audio files on this site, is owned and/or licensed by SCCE & HCCA or its suppliers and is subject to United States and international copyright, trademark and other intellectual property laws. Any third party logos and/or content provided herein is owned by such third parties and is used by permission herein. Your use of this site to is subject to our Terms Of Use and Privacy Statement.
Cookie settings