A recent $100,000 settlement obtained by the Office of Civil Rights (OCR) of the U.S. Department of Health and Human Services demonstrates the far reaching impact of HIPAA. On February 13, 2018, the OCR issued a press release regarding a settlement with a Receiver acting on behalf of Filefox, Inc., a medical records moving and storage company. Filefox was a HIPAA Business Associate of its health care clients, which were covered entities under HIPAA. The Receiver was appointed to liquidate the assets of Filefox, which had been voluntarily dissolved by the Illinois Secretary of State. It was alleged that an individual had left Protected Health Information (PHI) in an unsecured truck outside a Filefox facility to be taken to a shredding facility. The Receiver agreed to the payment of $100,000 and a Corrective Action Plan.
This settlement demonstrates that HIPAA obligations do not end when a business closes. It is also a reminder that businesses who receive or have access to PHI on a routine basis, due to relationships with Covered Entities (e.g., health care providers, health insurance companies) should have Business Associate Agreements with the Covered Entity and HIPAA Compliance Plans. Entities lacking proper security plans face greater sanctions.
In addition, even businesses that don’t handle PHI need to be aware of the requirements of the Florida Information Protection Act of 2014 (FIPA). Any entity that maintains personal information of clients or customers in electronic form is impacted. Personal information is any combination of a first and last name or first initial and last name with one other identifier including, social security, driver’s license, passport or credit card numbers or health history. Such covered entities must take reasonable measures to protect and secure such data, if maintained in electronic form and must report any breach of security affecting 500 or more individuals in Florida (F.S. Section 501.171).
This publication is for general information only. It is not legal advice, and legal counsel should be contacted before any action is taken that might be influenced by this publication.
Yes! Please sign me up to receive email alerts from other Gunster practice areas.
About Gunster
Gunster, Florida’s law firm for business, provides full-service legal counsel to leading organizations and individuals from its 13 offices statewide. Established in 1925, the firm has expanded, diversified and evolved, but always with a singular focus: Florida and its clients’ stake in it. A magnet for business-savvy attorneys who embrace collaboration for the greatest advantage of clients, Gunster’s growth has not been at the expense of personalized service but because of it. The firm serves clients from its offices in Boca Raton, Fort Lauderdale, Jacksonville, Miami, Naples, Orlando, Palm Beach, Stuart, Tallahassee, Tampa Bayshore, Tampa Downtown, Vero Beach, and its headquarters in West Palm Beach. With more than 280 attorneys and consultants, and over 290 committed professional staff, Gunster is ranked among the National Law Journal’s list of the 500 largest law firms and has been recognized as one of the Top 100 Diverse Law Firms by Law360. More information about its practice areas, offices and insider’s view newsletters is available at www.gunster.com.
