HHS OCR Sends Message To CEs And Their BAs: Protect ePHI Accessible Over The Internet

In its third resolution agreement of 2013, the Department of Health and Human Services, Office for Civil Rights (HHS OCR) today announced a $1.7 million resolution agreement with WellPoint, Inc., a health insurer and managed care company.  The resolution agreement stems from WellPoint's June 18, 2010 report to OCR regarding security weaknesses in an online application database which left the ePHI of 612,402 individuals accessible to unauthorized individuals over the Internet for almost 5 months between 2009-2010.  Information accessible included names, dates of birth, Social Security numbers, telephone numbers, and health information.    

In response to WellPoint's report, OCR initiated its investigation into WellPoint's compliance with the Privacy, Security, and Breach Notification Rules on September 9, 2010.  OCR's investigation indicated the following: