The Office of Civil Rights (OCR), a division of the U.S. Department of Health and Human Services (HHS), has settled violations of the Health Insurance Portability and Accountability Act (HIPAA) for $700,000. The covered entity, which provides genetic testing and clinical genomics services, filed a breach report with OCR in March 2020 after a January 2020 phishing incident. That incident exposed the protected health information (PHI) of 225,370 individuals. The exposed PHI included names, addresses, dates of birth, Social Security or driver’s license numbers, financial information, and extensive medical information.
Following an investigation, OCR determined that the covered entity failed to comply with HIPAA in three ways: