Mass General to pay $1 million to settle potential HIPAA privacy violations

The General Hospital Corporation and Massachusetts General Physicians Organization Inc. (Mass General) has agreed to pay the Department of Health and Human Services (HHS) $1 million to settle potential violations of the HIPAA privacy rule. The resolution involved the loss of protected health information (PHI) of 192 patients when an employee of Mass General left patient files on a commuter subway train. The files included daily office schedules for three days containing names and medical record numbers and billing encounter forms. They included PHI of patients with HIV/AIDS.

The HHS Office for Civil Rights (OCR) opened an investigation in response to a complaint from a patient whose PHI was lost. OCR found that Mass General failed to implement reasonable, appropriate safeguards to protect the privacy of PHI when removed from Mass General’s premises and impermissibly disclosed PHI.
To resolve the matter, Mass General agreed to pay $1 million and to enter into a three-year Resolution Agreement, which includes a corrective action plan (CAP) that requires Mass General to:
Develop and implement written policies and procedures on issues such as physical removal and transport of PHI, laptop encryptions and USB drive encryption that ensure PHI is protected when removed from Mass General’s premises;
Train workforce members on these policies and procedures and;
Designate an internal monitor who will conduct assessments of Mass General’s compliance with the CAP and render semi-annual reports to HHS for the three-year period.



Dallas L Alford IV, CPA is a licensed Certified Public Accountant in the state of North Carolina and owner of Atlantic Financial Consulting, a consulting firm that provides comprehensive medical billing services, practice management consulting, coding audits, Medicare compliance, Medicare RAC support and other general medical practice consulting services.
To learn more about Atlantic Financial Consulting you may visit their website at http://atlanticfinancial.us or contact Dallas L Alford IV, CPA directly at 1 888-428-2555, Ext. 200.