I missed this a few months ago when it first appeared, but today ran across an article from September in  Computerworld  that described the penalties levied by DHHS against Providence Health in Seattle for HIPAA violations. The amount they were fined, $100,000, is significant. It's the $25,000 maximum HIPAA fine times four, for the four EPHI loss incidents. The loss incidents had to do with laptops stolen from the organization that housed EPHI.

What is even more significant is the set of actions (3 year Corrective Action Plan is here) that were mandated by DHHS. These include:

- a risk assessment (an annual HIPAA requirement anyways)
- implementing security measures to reduce risks and vulnerabilities
- physical safeguards around offsite storage of EPHI, safeguards addressing transport of EPHI offsite
- encryption of portable devices, encryption of backup media
- physical security controls for portable computers
- workforce training
- monitor reviews of staff at the organization- essentially quarterly audits to ensure the prescribed controls are acually put into practice
- unannounced site visits
- annual reports, and more

It is nice to see DHHS taking HIPAA Security Rule compliance seriously enough to impose these security controls on a healthcare organization that has had issues. I don't think any of these security controls are particularly onerous- really they are best practive sorts of things. Healthcare organizations will treat IT security more seriously in the future, and fund it appropriate to the set of risks, including (now) increased regulatory compliance risk.

Jim