OCR Settles Potential HIPAA Violations With County Government For $215,000

To start 2014, the Department of Health and Human Services (HHS) Office for Civil Rights (OCR) issued its first resolution agreement of the year and its first settlement with a county government – signaling that even local and county governments, regardless of size, must safeguard the privacy and security of patient information in compliance with HIPAA.

Skagit County, Washington, located in Northwest Washington with approximately 118,000 residents, agreed to settle potential violations of the HIPAA Privacy, Security, and Breach Notification Rules with a $215,000 monetary payment and a three-year corrective action plan (CAP). The Skagit County Public Health Department provides essential services to residents who are unable to afford health care. The resolution agreement stems from the County's December 9, 2011 notification to HHS OCR that money receipts with electronic protected health information (ePHI) of seven individuals were accessed by unknown parties after the