HHS Office for Civil Rights settles with L.A. Care health plan over potential HIPAA security rule violations

Sept. 12, 2023
LA Care paid $1,300,000 to settle.

The U.S. Department of Health and Human Services’ Office for Civil Rights (OCR) announced a settlement of potential violations of the Health Insurance Portability and Accountability Act (HIPAA) Rules with LA Care.

OCR enforces the HIPAA Privacy, Security, and Breach Notification Rules that set the requirements that HIPAA-regulated entities must follow to protect the privacy and security of protected health information (PHI).  The settlement concludes two OCR investigations initiated from a large breach report and a media article regarding a separate security incident. Under the agreement, LA Care agreed to pay $1,300,000 and to implement a corrective action plan, discussed in further detail below, which identifies steps LA Care will take to resolve these potential violations of the HIPAA Security Rule and protect the security of electronic protected health information (ePHI). 

The potential violations in this case included:

  • failure to conduct an accurate and thorough risk analysis to determine risks and vulnerabilities to ePHI across the organization,
  • failure to implement security measures sufficient to reduce risks and vulnerabilities to ePHI to a reasonable and appropriate level,
  • failure to implement sufficient procedures to regularly review records of information system activity,
  • failure to perform a periodic technical and nontechnical evaluation in response to environmental or operational changes affecting the security of ePHI, and
  • failure to implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use ePHI.

OCR’s investigation found evidence of potential noncompliance with the HIPAA Privacy and Security Rules across LA Care’s organization, a serious concern given the size of this covered entity.  In addition to the monetary settlement, LA Care has agreed to take the following steps under a comprehensive corrective action plan that will be monitored for three years by OCR to ensure compliance with HIPAA:

  • Conduct an accurate and thorough risk analysis to determine risks and vulnerabilities to electronic patient/system data across the organization.
  • Develop and implement a risk management plan to address identified risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI.
  • Develop, implement, and distribute policies and procedures for a risk analysis and risk management plan.
  • Report to HHS when it conducts an evaluation due to an environmental and operational change that affects the security of ePHI in LA Care’s possession or control.
  • Report to HHS within thirty (30) days when workforce members fail to comply with the HIPAA Rules.

HHS release

ID 328976828 © Olga Korshunova | Dreamstime.com
dreamstime_xxl_328976828
ID 170384413 © Transversospinales | Dreamstime.com
dreamstime_xxl_170384413
ID 37133157 © Tyler Olson | Dreamstime.com
dreamstime_xxl_37133157
ID 267733296 © Yuri Arcurs | Dreamstime.com
dreamstime_xxl_267733296
ID 177061230 © Valerii Honcharuk | Dreamstime.com
dreamstime_xxl_177061230