Ill-Suited: Private Rights of Action and Privacy Claims
19 July 2019
The U.S. Chamber of Commerce Institute for Legal Reform has published “Ill-Suited: Private Rights of Action and Privacy Claims,” a white paper authored by Hogan Lovells’...
Blog: Chronicle of Data Protection | 16 August 2013
The importance of implementing effective data tracking, security and vendor management programs continues to be reinforced. A reminder came again in the form of a recently-announced $1.2 million settlement between the Department of Health and Human Services Office for Civil Rights (OCR) and a New York health plan. In 2010, Affinity Health Plan self-reported a HIPAA breach of electronic patient records relating to 345,000 people. Those records were stored in the internal memory of digital photocopiers leased by the plan. Post-lease, the company returned the photocopiers, but did not erase the hard drives embedded in the copiers. That mistake triggered an extensive investigation by OCR, an eventual settlement and the imposition of a corrective action plan. The settlement and corrective action plan is available here.In addition to the $1.2 million monetary settlement, the corrective action plan may also prove onerous. The plan requires the company to “use its best efforts” to attempt to retrieve the returned hard drives and safeguard them from “impermissible disclosure.” Failing that, the insurer must submit a description of the lengths it went to trying to get them back. Finally, the company agreed to evaluate risks to patient privacy and create strategies to eliminate these risks within 30 days of the settlement’s effective date of August 7, 2013. The case reminds us that breaches need not involve intrusion by hackers or criminals. They often involve simple mistakes, which can be avoided through compliance programs and contractual protections. For example, this type of situation may have been avoided by:
19 July 2019
The U.S. Chamber of Commerce Institute for Legal Reform has published “Ill-Suited: Private Rights of Action and Privacy Claims,” a white paper authored by Hogan Lovells’...