The HHS Office for Civil Rights (OCR) has fined Lahey Hospital in Massachusetts $850,000 for non-compliance with HIPAA privacy and security rules. HealthData Management reports the sanction stems from the theft of a laptop from an unlocked treatment room that contained protected health data on 599 patients. Lahey responded, saying the theft was an isolated incident, however, the investigation reportedly found a series of violations. As part of the settlement, the OCR has required that the hospital “address its history of noncompliance with the HIPAA rules by providing OCR with a comprehensive, enterprisewide risk analysis and corresponding risk management plan, as well as reporting certain events and providing evidence of compliance,” it said in a statement.
Full Story