Insider Breach, Email Attacks Net $1.7M in HIPAA Fines

An insider breach at a Florida pain management firm and an email breach at a Colorado pediatric hospital have resulted in more than $1.7 million in fines for HIPAA violations found by federal investigators. The two incidents affected fewer than 50,000 people.

See Also: Using the Netskope HIPAA Mapping Guide

The U.S. Department of Health and Human Services’ said on Tuesday that it imposed the $1.19 million civil monetary penalty against Gulf Coast Pain Consultants, which does business as Clearway Pain Solutions Institute, after an investigation into an insider breach the practice reported in 2019 affecting nearly 35,000 individuals.

HHS’ Office for Civil Rights on Thursday said it also levied a $548,265 civil monetary penalty against Children’s Hospital of Colorado following investigations into two email related breaches – a 2017 phishing attack affecting 3,370 individuals’ and a 2020 hack on three email accounts containing protected health information of 10,840 individuals.

Gulf Coast Incident

The pain management practice investigation centered on a former independent business consultant who was under contract. The contractor was accused of accessing the practice’s electronic health records containing patients’ protected health information to commit alleged Medicare claims fraud.

HHS OCR said Gulf Coast reported that the contractor was retained in May 2018 to provide business consulting services and stopped providing those services in August 2018.

But in February 2019, Gulf Coast discovered the former contractor continued to access the practice’s electronic medical records without authorization on three occasions to retrieve patients’ protected health information for use in potential fraudulent Medicare claims. Upon the discovery, Gulf Coast terminated the contractor’s access to its systems.

The compromised PHI included patient names, addresses, phone numbers, email addresses, dates of birth, Social Security numbers, chart numbers, insurance information and primary care information.

The former contractor, who was not named by HHS OCR, was later indicted for generating 6,500 false Medicare claims for services that were not rendered. He was ultimately found not guilty.

“Current and former workforce can present threats to healthcare privacy and security – risking continuity of care and trust in our healthcare system,” said Melanie Fontes Rainer, HHS OCR director in a statement.

“Effective cybersecurity and compliance with the HIPAA Security Rule means being proactive in reviewing who has access to health information and responding quickly to suspected security incidents.”

OCR investigation into the Gulf Coast incident found the practice committed four HIPAA security rule violations including failure to conduct an accurate and thorough risk analysis; failure to implement procedures to regularly review records of activity in information systems; failure to implement procedures for terminating former workforce members’ access to ePHI; and failure to implement procedures for establishing and modifying workforce members’ access to information systems.

HHS OCR issued a notice of proposed determination in August informing Gulf Coast that the agency would impose a civil monetary penalty. Gulf Coast waived its right to a hearing and did not contest OCR’s findings. HHS OCR issued its notice of final determination to Gulf Coast in September.

Gulf Coast did not immediately respond to Information Security Media Group’s request for comment on HHS OCR’s enforcement action against the practice.

Children’s Hospital Breaches

HHS OCR said it investigated Children’s Hospital Colorado following reported breaches involving a phishing attack that compromised an email account containing 3,370 individuals’ PHI in 2017 – and another breach in 2020 involving the compromise of three employee email accounts containing 10,840 individuals’ PHI.

The agency said its investigation determined that the first reported breach occurred because multifactor authentication was disabled on an email account.

The second breaches occurred, in part, when workforce members gave permission to unknown third parties to access their email accounts.

During its investigation, OCR also found violations related to the hospital’s failure to train workforce members on the HIPAA Privacy Rule, and the HIPAA Security Rule requirement to conduct a compliant risk analysis to determine the potential risks and vulnerabilities to ePHI in its systems.

“Email continues to be a very common way for cyberattackers to enter health information systems and jeopardized privacy and security,” Fontes Rainer said in a statement. “Healthcare entities should identify potential risks and vulnerabilities to email accounts and train their workforce to protect health information in those accounts.”

HHS OCR in June 2024 issued a notice of proposed determination seeking to impose a civil money penalty against the pediatric facility. Children’s Hospital Colorado waived its right to a hearing and did not contest OCR’s findings.

Children’s Hospital of Colorado did not immediately respond to ISMG’s request for comment.