A recent $100,000 settlement obtained by the Office of Civil Rights (OCR) of the U.S. Department of Health and Human Services demonstrates the far reaching impact of HIPAA. On February 13, 2018, the OCR issued a press release regarding a settlement with a Receiver acting on behalf of Filefox, Inc., a medical records moving and storage company. Filefox was a HIPAA Business Associate of its health care clients, which were covered entities under HIPAA. The Receiver was appointed to liquidate the assets of Filefox, which had been voluntarily dissolved by the Illinois Secretary of State. It was alleged that an individual had left Protected Health Information (PHI) in an unsecured truck outside a Filefox facility to be taken to a shredding facility. The Receiver agreed to the payment of $100,000 and a Corrective Action Plan.
This settlement demonstrates that HIPAA obligations do not end when a business closes. It is also a reminder that businesses who receive or have access to PHI on a routine basis, due to relationships with Covered Entities (e.g., health care providers, health insurance companies) should have Business Associate Agreements with the Covered Entity and HIPAA Compliance Plans. Entities lacking proper security plans face greater sanctions.
In addition, even businesses that don’t handle PHI need to be aware of the requirements of the Florida Information Protection Act of 2014 (FIPA). Any entity that maintains personal information of clients or customers in electronic form is impacted. Personal information is any combination of a first and last name or first initial and last name with one other identifier including, social security, driver’s license, passport or credit card numbers or health history. Such covered entities must take reasonable measures to protect and secure such data, if maintained in electronic form and must report any breach of security affecting 500 or more individuals in Florida (F.S. Section 501.171).
