In a case that shares at least three common themes with previous settlements, a Rhode Island health care system of teaching hospitals is paying the HHS Office for Civil Rights (OCR) more than $1 million following the 2017 theft of a worker’s personal laptop that contained patient information and implementing a two-year corrective action plan (CAP).^[1]

While lost or stolen laptops—which must lack encryption to be considered a breach at all—have been at the center of many settlements, OCR also sanctioned Lifespan Health System Affiliated Covered Entity (ACE) of Providence for what it considered an ill-configured ACE arrangement with its subsidiary hospitals and behavioral health organization.

This marks at least the third time OCR has taken an enforcement action for an alleged lack of an internal business associate agreement (BAA) and the second such settlement involving hospitals in Rhode Island. As this case and the most recent one in November—which included a penalty of more than $2 million—demonstrate, OCR is willing to levy a heavy price for what might seem to some as a technical violation.^[2]

Lifespan’s settlement, announced July 27, is the third resolution agreement OCR has released this year and came just a few days after the second. On July 23, OCR said Metropolitan Community Health Services of North Carolina, doing business as Agape Health Services, agreed to pay $25,000 and follow a CAP.^[3]

The compliance officer for Agape called the settlement “unfair” because it is pegged to a misdirected email sent in 2011 but, in an interview exclusive to RPP, said the agreement was necessary for the federally qualified health center to continue providing its essential services.^[4]

Lifespan bills itself as “Rhode Island’s first and largest health system,” created in 1994.^[5] According to the resolution agreement, Lifespan is an ACE consisting of “three academic teaching hospitals: Rhode Island Hospital and its Hasbro Children’s Hospital; The Miriam Hospital; and Bradley Hospital.”^[6] Also part of the system is Newport Hospital and Gateway Healthcare, a behavioral health provider.

The path to the $1.04 million settlement agreement began when a Rhode Island Hospital employee’s laptop was stolen, an incident Lifespan reported to OCR on April 21, 2017. The laptop contained protected health information (PHI) for 20,431 individuals. The settlement agreement doesn’t mention that it was a personal laptop owned by the employee, but Lifespan, in a statement to RPP, said it was.