As we noted earlier this month, Massachusetts General Hospital recently entered into a $1 million Resolution Agreement and Corrective Action Plan with the Department of Health and Human Services' Office of Civil Rights. This settlement stemmed from an incident on March 9, 2009, when a MGH employee was commuting on the subway, "removed documents containing PHI from her bag and placed them on the seat beside her. The documents were not in an envelope and were bound with a rubber band. Upon exiting the train, the MGH employee left the documents on the subway train and they were never recovered. These documents contained the PHI of 192 individuals." There was, however, no indication that any of the PHI was ever used in any way.

While the $1 million penalty is an attention-grabber, the elements of the Corrective Action Plan are also likely to be at least as costly and will be very burdensome. They include:

  • three (3) years of reporting obligations from MGH to OCR;
  • adoption of new policies that OCR must review and approve;
  • training on these new policies that OCR must review and approve;
  • retention of a monitor who will conduct:
    • unannounced site inspections of MGH’s locations/departments/practices;
    • interviews with any members of the workforce who use PHI;
    • interviews with any members of the workforce involved in implementing the safeguards required by the CAP;
    • inspection of a sample of laptops and USB flash drives that contain ePHI and are under the control of workforce members to ensure that such devices satisfy all applicable requirements of the Policies and Procedures; and
    • inspection of relevant documents and interviews with workforce members for the purpose of confirming consistent training, implementation, and enforcement of the Policies and Procedures among workforce members.
  • submission of semi-annual monitor reports;
  • self-reporting of any "significant violations" of the CAP;
  • submission of an implementation report after 120 days of the CAP; and
  • annual reports to the monitor, which will be passed on to OCR.

This is a pretty heavy burden to carry around for three years. In fact, the CAP looks much more like a Corporate Integrity Agreement of the type entered into by a pharmaceutical manufacturer after a health care fraud settlement. I suspect that is precisely the message that OCR wanted to send.