All posts in State AGs

Increasing State HIPAA Enforcement: Highlights from 2018

Daniel Solove
Founder of TeachPrivacy

State HIPAA Enforcement - increasing 02

There have been quite a number of state HIPAA enforcement cases this year, and one expert points out a trend toward increasing state enforcement of HIPAA.

An article in Data Breach Today discusses a number of state HIPAA enforcement cases.  Here are some of the ones discussed:

Massachusetts — $75,000 settlement with McLean Hospital for a data breach involving 1,500 victims based on an employee who routinely took home unencrypted backup tapes with PHI.  From the state press release:

The AG’s complaint alleges that McLean, a psychiatric hospital in Belmont, allowed an employee to regularly take home eight unencrypted back-up tapes containing clinical and demographic information from the Harvard Brain Tissue Resource Center that the hospital possessed. The tapes contained personal information such as names, social security numbers, diagnoses and family histories. When the employee was terminated from her position at McLean in May 2015, she only returned four of the tapes, and the hospital was unable to recover the others.

New Jersey — $100,000 settlement with EmblemHealth for a 2016 breach involving 81,000 victims.  Details from the state’s press release:

The incident at issue took place on October 3, 2016 when EmblemHealth’s vendor sent a paper copy of EmblemHealth’s Medicare Part D Prescription Drug Plan’s Evidence of Coverage to 81,122 of its customers, including 6,443 who live in New Jersey.

The label affixed to the mailing improperly included each customer’s HICN, which incorporates the nine digits of the customer’s Social Security number, as well as an alphabetic or alphanumeric beneficiary identification code. (The number shown was identified as the “Package ID#” on the mailing label and did not include any separation between the digits.)

During its investigation, the Division found that following the departure of the EmblemHealth employee who typically prepared the Evidence of Coverage mailings, the task was assigned to a team manager of EmblemHealth’s Medicare Products Group, who received minimal training specific to the task and worked unsupervised. Before forwarding the data file to the print vendor, this team manager failed to remove the patient HICNs from the electronic data file.

Continue Reading

Largest COPPA Penalty Ever – NY AG Settles with Oath (Formerly AOL)

Daniel Solove
Founder of TeachPrivacy

COPPA - TeachPrivacy Privacy Awareness Training 01

On December 4, 2018, New York Attorney General Barbara D. Underwood announced a $4.95 million settlement with Oath, Inc. (formerly known as AOL), for violating the Children’s Online Privacy Protection Act (COPPA). This is the largest penalty in a COPPA enforcement case in U.S. history.

Continue Reading

Update on the Kansas Teen Sex Medical Records Case

Daniel Solove
Founder of TeachPrivacy

Kansas

A few days ago, I blogged about a case in Kansas where the Attorney General interpreted a law prohibiting sex with minors under the age of 16 as requiring doctors to report any sexual activity by people under 16 to the state authorities. Recently, the Kansas Supreme Court issued an opinion, Alpha Medical Clinic v. Anderson, strongly limiting the Attorney General’s reporting requirement. Relying in significant part on Whalen v. Roe, 429 U.S. 589 (1977) (discussed in depth in my earlier post), the Kansas Supreme Court reasoned:

Continue Reading