US Hospice of North Idaho 2013 Physical Action (Q15903)
From Open Risk Manual
A data breach risk event
| Language | Label | Description | Also known as |
|---|---|---|---|
| English | US Hospice of North Idaho 2013 Physical Action |
A data breach risk event |
Statements
4B6434EC-6AA1-4966-97D8-0BDCAED0C50B
January 2013
0 references
The June 2010 theft of an unencrypted laptop from an employees car resulted in the exposure of patient information. The HHS Office for Civil Rights investigated the breach and found that HONI had not conducted a risk analysis to safeguard electronic protected health information. It was also discovered that HONI did not meet a HIPAA Security Rule that required them to have policies or procedures in place to address mobile device security. HONI agreed to pay the U.S. Department of Health and Human Services (HHS) $50,000 regarding potential Health Insurance Portability and Accountability Act of 1996 Security Rule violations. HONI also began taking extensive steps to improve their HIPAA Privacy and Security compliance program since the June 2010 breach. (English)
