Care New England Health system to pay $400000 over HIPAA violation

The payment comes on top of a $150,000 settlement reached earlier between Women & Infants Hospital in Providence and the MA attorney general's office for potential HIPAA violations stemming from a 2012 data breach of about 14,000 patient records on 19 lost and unencrypted backup tapes.

Rhode Island's Care New England Health system has been fined $400,000 by the Office for Civil Rights for alleged HIPAA violations. The tapes held protected health information, including patient name, date of birth, date of exam, physician names, and, in some instances, Social Security Numbers.

CNE provides corporate support for numerous hospitals and healthcare providers in MA and Rhode Island, including in finance, human resources, information services, technical support, insurance, compliance, and administrative functions, HHS said.

Information technology services, including information security, were handled by WIH's parent company, Care New England Health Systems (CNE). The federal agency, while not barred from doing so, did not pursue a penalty against Women & Infants Hospital for the data breach itself or for failing to notify affected patients since the incident was adequately covered under the MA state settlement agreement, the Office for Civil Rights statement said.

"The Omnibus Final Rule outlined necessary changes to established business associate agreements and new requirements which include provisions for reporting", she continued. According to the resolution agreement, WIH and CNE had a business associate agreement effective March 2005, but it was not updated until August 2015 following OCR's investigation into this data breach.

A $400,000 payment is meant to address the federal probe, which found that WIH disclosed protected health information (PHI) to CNE, without "obtaining satisfactory assurances as required under HIPAA", in the form of a written business associate agreement that CNE would safeguard the PHI.

On July 17, 2014, Women and Infants entered into a consent judgment with the Massachusetts Attorney General's Office and reached a settlement of $150,000.

  • Zachary Reyes