In a significant development highlighting the importance of data security in the healthcare sector, MedEvolve, an Arkansas-based software services provider, has settled a potential HIPAA violation with the U.S. Department of Health and Human Services' Office for Civil Rights (OCR). The violation, involving the exposure of protected health information on an unsecured server, underscores the critical need for stringent data protection measures in the healthcare industry.
The Office for Civil Rights has settled a potential violation of the Health Insurance Portability and Accountability Act (HIPAA) with MedEvolve, Inc. The Arkansas-based company, which provides software services to healthcare entities, was investigated following a data breach where a server containing the protected health information of 230,572 individuals was left unsecured and accessible on the internet.
HIPAA is a federal law that sets national standards to protect the privacy and security of health information. The potential HIPAA violations, in this case, include the lack of an analysis to determine risks and vulnerabilities to electronic protected health information across the organization and the failure to enter into a business associate agreement with a subcontractor. MedEvolve has paid OCR a $350,000 monetary settlement and agreed to implement a corrective action plan.
"Ensuring that security measures are in place to protect electronic protected health information where it is stored is an integral part of cybersecurity and the protection of patient privacy," said OCR Director Melanie Fontes Rainer. "HIPAA regulated entities must ensure that they are not leaving patient health information unsecured on network servers available to the public via the internet."
The investigation was initiated in July 2018 following a breach notification report stating that an FTP server containing electronic protected health information was openly accessible to the internet. The information included patient names, billing addresses, telephone numbers, primary health insurer, and doctor's office account numbers, and in some cases, Social Security numbers.
As part of the settlement agreement, MedEvolve will be monitored for two years by OCR to ensure compliance with the HIPAA Security Rule. The company has agreed to conduct a risk analysis, develop a risk management plan, revise its written policies and procedures, augment its HIPAA and Security Training Program, and report to HHS when workforce members fail to comply with MedEvolve's written policies and procedures.
As part of the settlement, MedEvolve has entered into a Corrective Action Plan (CAP) with the HHS. The CAP outlines several steps MedEvolve must take to ensure compliance with HIPAA regulations moving forward. These include:
Related: HIPAA Compliant Email: The Definitive Guide
According to Paubox's April 2023 breach report, Network server breaches affected the most people in March 2023. Cerebral, Inc. had the most significant breach that affected 3,179,835 people. ZOLL Services LLC had the second-largest breach, which affected 997,097 people.
Network server breaches were the most popular attack vectors for bad actors over the last five March months. Over 10 million individuals had their data accessed via 114 network server breaches during this time.