Faegre Drinker Biddle & Reath LLP, a Delaware limited liability partnership | This website contains attorney advertising.
January 24, 2017

Second HIPAA Enforcement Action of 2017 – Failure to Safeguard Electronic Health Information

Key Takeaways

  • Puerto Rico Life Insurance Company failed to safeguard ePHI on USB Storage Device
  • $2.2 million penalty plus corrective action plan

The U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR) has announced a $2.2 million Health Insurance Portability and Accountability Act (HIPAA) settlement with MAPFRE Life Insurance Company of Puerto Rico (“MAPFRE Life”) regarding the impermissible disclosure of unsecured electronic protected health information (ePHI). On September 29, 2011, MAPFRE Life reported to OCR that a USB data storage device described as a pen drive containing the protected health information (PHI) of 2,209 individuals was stolen from its IT department where it was left overnight. The pen drive included the complete names, dates of birth and Social Security numbers of the affected individuals. As a result of this report, OCR investigated and determined that MAPFRE Life did not conduct a thorough assessment of the risks and threats to the confidentiality, integrity, and availability of ePHI and failed to implement security measures sufficient to reduce these vulnerabilities to a reasonable and appropriate level, including the failure to encrypt ePHI. MAPFRE did not utilize encryption or an equivalent alternative measure on its laptops and removable storage media until September 1, 2014. OCR also determined that MAPFRE Life failed to implement reasonable and appropriate policies and procedures to comply with the requirements to safeguard ePHI and did not implement a security awareness and training program for all members of its workforce.

MAPFRE Life agreed to settle for $2,204,182 and enter into a three-year Corrective Action Plan aimed at addressing the noncompliance discovered by OCR during its initial investigation.  In its press release, OCR noted that this high settlement amount balances potential violations of the HIPAA rules with MAPFRE’s financial standing. MAPFRE Life is a multinational insurance company headquartered in Spain that underwrites and administers a variety of insurance products and services in Puerto Rico, including personal and group health insurance plans.

This settlement, the second HIPAA settlement of 2017, emphasizes the need for covered entities to protect all types of PHI. Earlier this month, Presence Health, an Illinois health care network, settled with OCR for $475,000 and agreed to a two-year corrective action plan resulting from a delay in issuing breach notifications following the breach of unsecured PHI. A Client Alert regarding this earlier settlement is available here. Together, these settlements signal that 2017 may be another highly active year for HIPAA enforcement.

If you have any questions about the recent settlements or HIPAA compliance, please contact any member of Drinker Biddle’s Health Care Team or Information Privacy, Security and Governance Team.

The material contained in this communication is informational, general in nature and does not constitute legal advice. The material contained in this communication should not be relied upon or used without consulting a lawyer to consider your specific circumstances. This communication was published on the date specified and may not include any changes in the topics, laws, rules or regulations covered. Receipt of this communication does not establish an attorney-client relationship. In some jurisdictions, this communication may be considered attorney advertising.

Related Industries

The Faegre Drinker Biddle & Reath LLP website uses cookies to make your browsing experience as useful as possible. In order to have the full site experience, keep cookies enabled on your web browser. By browsing our site with cookies enabled, you are agreeing to their use. Review Faegre Drinker Biddle & Reath LLP's cookies information for more details.