Texas Health System Settles Potential HIPAA Disclosure Violations

Share on facebook
Share on google
Share on twitter
Share on linkedin

According to a press release, issued by HHS.gov, Memorial Hermann Health System (MHHS) has agreed to pay $2.4 million to the U.S. Department of Health and Human Services (HHS) and adopt a comprehensive corrective action plan to settle potential violations of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule. MHHS is a not-for-profit health system located in Southeast Texas, comprised of 16 hospitals and specialty services in the Greater Houston area.

The HHS Office for Civil Rights (OCR) initiated a compliance review of MHHS based on multiple media reports suggesting that MHHS disclosed a patient’s protected health information (PHI) without an authorization. In September 2015, a patient at one of MHHS’s clinics presented an allegedly fraudulent identification card to office staff. The staff immediately alerted appropriate authorities of the incident, and the patient was arrested. This disclosure of PHI to law enforcement was permitted under the HIPAA Rules. However, MHHS subsequently published a press release concerning the incident in which MHHS senior management approved the impermissible disclosure of the patient’s PHI by adding the patient’s name in the title of the press release. In addition, MHHS failed to timely document the sanctioning of its workforce members for impermissibly disclosing the patient’s information.

“Senior management should have known that disclosing a patient’s name on the title of a press release was a clear HIPAA Privacy violation that would induce a swift OCR response,” said OCR Director Roger Severino. “This case reminds us that organizations can readily cooperate with law enforcement without violating HIPAA, but that they must nevertheless continue to protect patient privacy when making statements to the public and elsewhere.”

In addition to a $2.4 million monetary settlement, a corrective action plan requires MHHS to update its policies and procedures on safeguarding PHI from impermissible uses and disclosures and to train its workforce members. The corrective action plan also requires all MHHS facilities to attest to their understanding of permissible uses and disclosures of PHI, including disclosures to the media.

Techgardens offers a vulnerability assessment to review the compliance of your organization against regulatory requirements. Our final report, which is typically over 200 pages, will raise questions to your organization of potential compliance issues. If a company is subject to HIPAA engages us for a Vulnerability Assessment, you would receive a detailed report that flags any areas that may be an issue based on our reading of the HIPAA Administration and Security Rules. Although final determination is between your organization and USDHHS/OCR, as a risk assessor, we do make a finding and make recommendations for remediation.

Learn more about our Vulnerability Assessment.

Contact us for more information on how we can help your organization.

Ready to Speak to us About Your Project?

Curious why you should consider us for your next IT project?

Read 5 Things to Consider when Hiring a Systems Integrator.

Questions? Get in Touch

Further Reading:

Interested in Learning More?

Why Techgardens?

Techgardens is a leading systems integrator founded in 2009 with headquarters in New York City. We specialize in IT consulting, cyber security, network infrastructure, enterprise storage, and cloud computing solutions. Techgardens selects the best technology to appropriately match IT solutions that provide efficiency and return on investment. Our team of engineers design and build customized IT solutions that meet the unique needs of our customers; exceeding their expectations. Our technical team has over 50 years of combined experience working in the financial, healthcare, education, government, legal, manufacturing, media, energy and retail verticals. We are staffed with CISSPs, Network Engineers and Systems Administrators with offices in New York, Maryland, Pennsylvania, and North Carolina. We serve customers and industries throughout the US.

Call Now ButtonClick to Call Techgardens

Cyber criminals won’t hesitate.

Neither should you.

Prepare for the Unexpected

Give us just 15 minutes of your time to discuss a few options with you.