The Department of Health and Human Services (HHS) Office for Civil Rights (OCR) has issued a letter calling the HIPAA physical security safeguards for electronic protected health information (ePHI), an "often overlooked" element of the HIPAA Security Rule. There is a common trend among health care professionals to favor cybersecurity safeguards over HIPAA physical security measures, which is the reason behind OCR's letter. HIPAA regulation clearly outlines the [...]

The largest data breach of 2018 (so far) has been claimed by a Midwestern health network. UnityPoint Health (UPH) has reported its second data breach of 2018, this time affecting 1.4 million patient records. On July 30, 2018, UnityPoint Health reported that the protected health information (PHI) of 1.4 million patients was compromised after a recent phishing attack infiltrated their email servers. The exposed PHI included patient info [...]

With so many HIPAA fines making headlines over the 20+ years since HIPAA regulation was first enacted, it's hard to keep track of some of the more significant fines and figures. Even though there have been landmark fines for HIPAA compliance--especially over the past four years--the fact of the matter remains that there are standard trends to HIPAA enforcement that all health care professionals should be aware of. When [...]

A former University of Pittsburgh Medical Center (UPMC) employee was indicted by a federal grand jury for criminal HIPAA violations. The Pittsburgh federal grand jury charged the former patient information coordinator with six counts of wrongfully obtaining and disclosing protected health information (PHI). HIPAA regulation defines PHI as any demographic information that can be used to identify a patient. The UPMC employee used her position to illegally obtain [...]