First OCR Resolution For Data Breach Involving Less Than 500 Patients: No Breach Is "Too Small"

The Department of Health and Human Services, Office for Civil Rights (OCR) reached its first settlement for a breach involving data regarding less than 500 individuals. Under the December 2012 settlement, the Hospice of North Idaho (HONI) will pay OCR a $50,000 penalty to resolve allegations that it violated the HIPAA Security Rule. The breach occurred in June 2010 with the theft of an unencrypted laptop computer containing the electronic protected health information (ePHI) of 441 HONI patients. OCR investigated the breach after HONI disclosed it in its annual report of breaches that involved less than 500 individuals required under the HITECH Act.

The Resolution Agreement subjects HONI to a two-year Corrective Action Plan (CAP), whereby it must closely monitor and promptly investigate any potential violations of HIPAA Privacy and Security policies and procedures by its employees. If HONI determines that a violation (Reportable Event) occurred, it must report the