The U.S. Department of Health and Human Services (“HHS”) announced last week that Affinity Health Plan, Inc. will settle potential violations of the HIPAA Privacy and Security Rules for more than $1.2 Million because it failed to wipe the hard drives when it returned leased photocopiers.

This settlement is the most recent in a long line of breaches which triggered self-reporting obligations.  By now, HIPAA covered entities are certainly familiar with the concept of media notification.  This settlement, however, highlights a different type of media notification — one which is to be avoided.

As required by the Health Information Technology for Economic and Clinical Health (“HITECH”), Affinity notified the HHS Office for Civil Rights (“OCR”) in April of 2010 of a breach.  Affinity had been informed by a representative of CBS Evening News that, as part of an investigatory report, CBS had purchased a photocopier previously leased by Affinity.  CBS informed Affinity that the copier that Affinity had used contained confidential medical information on the hard drive.

So What Went Wrong?

OCR’s investigation indicated that Affinity impermissibly disclosed protected health information when it returned multiple photocopiers to leasing agents without erasing the data contained on the copier hard drives.  In addition, the investigation revealed that Affinity failed to incorporate the electronic protected health information (ePHI) stored on photocopier hard drives in its analysis of risks and vulnerabilities as required by the Security Rule, and failed to implement policies and procedures when returning the photocopiers to its leasing agents.  The HHS press release states that Affinity estimated that up to 344,579 individuals may have been affected by this breach.

Key Takeaways

Take another look.  OCR Director Leon Rodriguez highlighted the obvious:

“Make sure that all personal information is wiped from hardware before it’s recycled, thrown away or sent back to a leasing agent.”

More general, however, is his reminder that

“HIPAA covered entities are required to undertake a careful risk analysis to understand the threats and vulnerabilities to individuals’ data, and have appropriate safeguards in place to protect this information.”

When undertaking a risk analysis, covered entities must carefully diagnose and consider each and every location where PHI might reside.  These might not always be as obvious as they seem.

Additional Guidance

HHS offers covered entities the following resources to consider when undertaking a risk analysis:

The Settlement Agreement is available here.