Largest-ever HIPAA settlement rings in at $5 million, should be a lesson to providers sharing computer networks, feds announce

Share this article:

New York Presbyterian Hospital and Columbia University have entered into the largest-ever government settlement over an electronic data breach, totaling $4.8 million, the Department of Health and Human Services announced Wednesday. 

The breach occurred when a Columbia University physician and computer application developer attempted to deactivate a server he personally owned, which was on a data network shared with New York Presbyterian, according to HHS. The two organizations operate jointly as New York Presbyterian Hospital/Columbia University Medical Center.

Because “technical safeguards” were lacking, deactivating the server allowed personal health information of about 6,800 patients to be accessed through public Internet search engines, HHS explained. The providers reported the breach in 2010, after someone found the personal information of a deceased loved one on the Web.

The settlement should be cautionary for joint healthcare providers that both are covered by Health Insurance Portability and Accountability Act provisions, said Christina Heide, acting deputy director for health information privacy at the HHS Office of Civil Rights.

“When entities participate in joint compliance arrangements, they share the burden of addressing the risks to protected health information,” She said. “Our cases against NYP and CU should remind healthcare organizations of the need to make data security central to how they manage their information systems.”

New York Presbyterian's share of the settlement totaled about $3.3 million, and Columbia's came to $1.4 million. Both have agreed to a “substantive corrective action plan,” including risk analysis and management, HHS noted.

Share this article:

More in News

Expert says providers often wrongly threatened by PEPPER reports

Instead of fearing further scrutiny by federal authorities, providers should embrace the opportunity to get feedback in the form of PEPPER reports, legal experts said Monday at the LeadingAge annual meeting in Nashville.

Healthcare reform already driving diverse, dynamic long-term care models, LeadingAge leaders say

Healthcare reform already driving diverse, dynamic long-term care ...

One way to gauge the effects is healthcare reform is by looking at ongoing changes to the continuing care retirement community model, LeadingAge officials said Monday at the association's annual ...

Federal court: Nursing home can be sued for firing hairdresser who can ...

Is the ability to transport residents in their wheelchairs an essential function of a nursing home hairdresser? A federal appeals court says it's a valid question and is allowing a hairdresser to sue a facility that fired her.