Nixon Peabody LLP

  • People
  • Capabilities
  • Insights
  • About

Trending Topics

    • People
    • Capabilities
    • Insights
    • About
    • Locations
    • Events
    • Careers
    • Alumni

    Practices

    View All

    • Affordable Housing
    • Community Development Finance
    • Corporate & Finance
    • Cybersecurity & Privacy
    • Environmental
    • Franchising & Distribution
    • Government Investigations & White Collar Defense
    • Healthcare
    • Intellectual Property
    • International Services
    • Labor & Employment
    • Litigation
    • Private Wealth & Advisory
    • Project Finance
    • Public Finance
    • Real Estate
    • Regulatory & Government Relations

    Industries

    View All

    • Cannabis
    • Consumer
    • Energy
    • Entertainment
    • Financial Services
    • Healthcare
    • Higher Education
    • Infrastructure
    • Manufacturing
    • Non Profit
    • Real Estate
    • Technology

    Value-Added Services

    View All

    • Alternative Fee Arrangements

      Developing innovative pricing structures and alternative fee agreement models that deliver additional value for our clients.

    • Continuing Education

      Advancing professional knowledge and offering credits for attorneys, staff and other professionals.

    • Crisis Advisory

      Helping clients respond correctly when a crisis occurs.

    • DEI Strategic Services

      Providing our clients with legal, strategic, and practical advice to make transformational changes in their organizations.

    • eDiscovery

      Leveraging law and technology to deliver sound solutions.

    • Global Services

      Delivering seamless service through partnerships across the globe.

    • Innovation

      Leveraging leading-edge technology to guide change and create seamless, collaborative experiences for clients and attorneys.

    • IPED

      Industry-leading conferences focused on affordable housing, tax credits, and more.

    • Legal Project Management

      Providing actionable information to support strategic decision-making.

    • Legally Green

      Teaming with clients to advance sustainable projects, mitigate the effects of climate change, and protect our planet.

    • Nixon Peabody Trust Company

      Offering a range of investment management and fiduciary services.

    • NP Capital Connector

      Bringing together companies and investors for tomorrow’s new deals.

    • NP Second Opinion

      Offering fresh insights on cases that are delayed, over budget, or off-target from the desired resolution.

    • NP Trial

      Courtroom-ready lawyers who can resolve disputes early on clients’ terms or prevail at trial before a judge or jury.

    • Social Impact

      Creating positive impact in our communities through increasing equity, access, and opportunity.

    1. Home
    2. Insights
    3. Articles
    4. OCR enforcement emphasizes the importance of HIPAA Security Rule complianceArticles

    Article

    OCR enforcement emphasizes the importance of HIPAA Security Rule compliance

    June 9, 2021

    Share

    By Valerie Montague

    Georgia clinical laboratory agrees to a robust Corrective Action Plan and $25,000 settlement amount for “systemic noncompliance” with the HIPAA requirements.

    On May 25, 2021, the U.S. Department of Health and Human Services, Office for Civil Rights (OCR) announced a settlement with a clinical laboratory for noncompliance with the HIPAA Security Rule.  Peachstate Health Management, Inc. d/b/a AEON Clinical Laboratories (Peachstate) is a CLIA-certified laboratory that provides clinical and genetic testing services.  It is regulated as a covered entity under HIPAA.  Pursuant to its settlement with OCR, Peachstate agreed to pay $25,000 and enter into a three-year Corrective Action Plan.

    The OCR settlement with Peachstate originated from a breach reported to OCR by the U.S. Department of Veterans Affairs (VA) in January 2015.  That breach involved a business associate of the VA, Authentidate Holding Corporation (AHC).  During its 2016 compliance review of AHC, OCR determined that AHC acquired Peachstate and, in December, 2017, initiated a compliance review of Peachstate.  The passage of more than six years from the initial breach report to the settlement with Peachstate illustrates the time that it can take for an investigation to be resolved, particularly if there are multiple entities involved.

    While investigating Peachstate, OCR found “systemic noncompliance” with the HIPAA Security Rule.  In particular, OCR determined that Peachstate failed to conduct an accurate and thorough enterprise-wide security risk assessment, that it failed to implement measures to reduce security risks and vulnerabilities, that it did not implement mechanisms to record and examine information system activity, and that it failed to enact Security Rule policies and procedures.

    While the financial settlement of $25,000 is not a very high amount relative to many of OCR’s enforcement actions, most Corrective Action Plans end after two years, rather than the three years required for Peachstate.  In addition, OCR requires Peachstate to hire an independent monitor with HIPAA compliance expertise to review Peachstate’s compliance with the Corrective Action Plan and to assist Peachstate with its Security Rule compliance, which also is not a standard requirement for OCR settlements.  These serve as important reminders to covered entities and business associates that the financial aspect of an OCR settlement should never be viewed as the only “expense” resulting from HIPAA enforcement.  Entities that have put into place a cursory HIPAA compliance program, or who are not conducting periodic and comprehensive security risk assessments or otherwise updating HIPAA compliance when necessary should understand that ongoing compliance efforts and expenses may be significantly more manageable than those resulting from an OCR enforcement action or settlement.

    PrivacyPrivacyHealthcareHealth Care And Hipaa

    Practices

    Cybersecurity & PrivacyHealthcare

    Subscribe to stay informed of the latest legal news, alerts, and business trends.Subscribe

    • People
    • Capabilities
    • Insights
    • About
    • Locations
    • Events
    • Careers
    • Alumni
    • © 2023 Nixon Peabody. All rights reserved
    • Privacy Policy
    • Terms of Use
    • Statement of Client Rights
    • Supplier Diversity Program
    • Nixon Peabody International LLC
    • PAL