First HIPAA Resolution Agreement Of 2013 - And It Certainly Will Not Be The Last

The HHS Office of Civil Rights (OCR) announced its first HIPAA Resolution Agreement of 2013 last week.  According to the press release, Idaho State University (ISU) must pay OCR $400,000 and comply with the terms of a two-year corrective action plan (CAP) to address violations of the HIPAA Security Rule, which describes the technical, administrative, and physical safeguards against unauthorized access to electronic personal health information (ePHI).

ISU self-disclosed the exposure of the ePHI of approximately 17,500 patients at one of its health system's facilities in August 2011.  The patients' ePHI had become compromised when ISU staff disabled firewall protections on a server for one of its 29 outpatient clinics.  ISU officials did not discover the "hole" in the system's security for over ten months – a fact underlying OCR's determination that "ISU's [privacy and security] risk analyses and assessments of its clinics were incomplete and inadequately identified