First HIPAA Settlement Involving Wireless Health Services Provider

We have previously written that the Internet of Things continues to spawn new cybersecurity and privacy concerns. These vulnerabilities have already served as plot devices for shows such as Homeland. Now, the U.S. Department of Health and Human Services, Office for Civil Rights (OCR), has announced its first settlement with a wireless services provider.

The provider, which provides mobile monitoring to patients at risk for cardiac arrhythmias, had reported the theft of a laptop containing the electronic protected health information (ePHI) of approximately 1,400 individuals.

OCR's investigation cited several factors that led to a finding of non-compliance:

• Insufficient risk analysis and risk management processes in place at the time of the theft;