[{"innerBlocks":[],"name":"core\/freeform","postId":241,"blockType":{"name":"core\/freeform","keywords":[],"attributes":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"}},"providesContext":[],"usesContext":[],"selectors":[],"supports":{"className":false,"customClassName":false,"reusable":false},"styles":[],"variations":[],"apiVersion":3,"title":"Classic","description":"Use the classic WordPress editor.","category":"text"},"originalContent":"Virginia-based Sentara Hospitals will pay the Department of Health and Human Services\u2019 Office for Civil Rights nearly $2.2 million to settle potential HIPAA violations. The agreement between OCR and Sentara, which operates 12 acute care hospitals with more than 300 sites of care throughout Virginia and North Carolina, is the result of allegations that the healthcare provider didn\u2019t properly notify the agency of a breach of unsecured protected health information.

According to OCR, the agency received a complaint in April 2017 alleging that Sentara had sent a bill to an individual containing another patient\u2019s protected health information. In fact, OCR\u2019s investigation discovered that Sentara mailed 577 patients\u2019 health information to wrong addresses; this shared information included patients\u2019 names, account numbers and dates of services.\u201cSentara reported this incident as a breach affecting eight individuals, because Sentara concluded, incorrectly, that unless the disclosure included patient diagnosis, treatment information or other medical information, no reportable breach of PHI had occurred,\u201d contends HHS. \u201cSentara persisted in its refusal to properly report the breach even after being explicitly advised of their duty to do so by OCR. OCR also determined that Sentara failed to have a business associate agreement in place with Sentara Healthcare, an entity that performed business associate services for Sentara.\u201dBesides agreeing to pay $2.175 million to HHS, Sentara has entered into a corrective action plan\u2014 including two years of monitoring\u2014with which the provider has agreed to comply. \u201cHIPAA compliance depends on accurate and timely self-reporting of breaches because patients and the public have a right to know when sensitive information has been exposed,\u201d said OCR Director Roger Severino in a written statement. \u201cWhen healthcare providers blatantly fail to report breaches as required by law, they should expect vigorous enforcement action by OCR.\u201dThe OCR-Sentara resolution agreement and corrective action plan can be found here.<\/a>","saveContent":"Virginia-based Sentara Hospitals will pay the Department of Health and Human Services\u2019 Office for Civil Rights nearly $2.2 million to settle potential HIPAA violations. The agreement between OCR and Sentara, which operates 12 acute care hospitals with more than 300 sites of care throughout Virginia and North Carolina, is the result of allegations that the healthcare provider didn\u2019t properly notify the agency of a breach of unsecured protected health information.

According to OCR, the agency received a complaint in April 2017 alleging that Sentara had sent a bill to an individual containing another patient\u2019s protected health information. In fact, OCR\u2019s investigation discovered that Sentara mailed 577 patients\u2019 health information to wrong addresses; this shared information included patients\u2019 names, account numbers and dates of services.\u201cSentara reported this incident as a breach affecting eight individuals, because Sentara concluded, incorrectly, that unless the disclosure included patient diagnosis, treatment information or other medical information, no reportable breach of PHI had occurred,\u201d contends HHS. \u201cSentara persisted in its refusal to properly report the breach even after being explicitly advised of their duty to do so by OCR. OCR also determined that Sentara failed to have a business associate agreement in place with Sentara Healthcare, an entity that performed business associate services for Sentara.\u201dBesides agreeing to pay $2.175 million to HHS, Sentara has entered into a corrective action plan\u2014 including two years of monitoring\u2014with which the provider has agreed to comply. \u201cHIPAA compliance depends on accurate and timely self-reporting of breaches because patients and the public have a right to know when sensitive information has been exposed,\u201d said OCR Director Roger Severino in a written statement. \u201cWhen healthcare providers blatantly fail to report breaches as required by law, they should expect vigorous enforcement action by OCR.\u201dThe OCR-Sentara resolution agreement and corrective action plan can be found here.<\/a>","order":0,"get_parent":{},"attributes":[],"attributesType":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"}},"dynamicContent":""}]

Sentara Hospitals reaches $2.175M HIPAA settlement with OCR

More for you