Back to NYSDA Blog

You are here

April 20, 2017

OCR Takes Action Against CCDH for HIPAA Violations

The United States Office for Civil Rights (OCR) has taken action against the Center for Children’s Digestive Health (CCDH) for violations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) that included failing to have a HIPAA business associate agreement (BAA) in place with a company that stored patient information for CCDH.  The action is interesting in that it exclusively focuses on the HIPAA obligations to have appropriate BAAs in place.  You can read the OCR announcement and summary of its action against CCDH below, with links to the complete Resolution Agreement and OCR guidance on HIPAA BAAs.

April 20, 2017

No Business Associate Agreement? $31K Mistake 

The Center for Children’s Digestive Health (CCDH) has paid the United States Office for Civil Rights (OCR) $31,000 to settle potential violations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule and agreed to implement a corrective action plan.  CCDH is a small, for-profit health care provider with a pediatric subspecialty practice that operates its practice in seven clinic locations in Illinois.

In August 2015, OCR initiated a compliance review of CCDH following an initiation of an investigation of a business associate, FileFax, Inc., which stored records containing protected health information (PHI) for CCDH.  While CCDH began disclosing PHI to Filefax in 2003, neither party could produce a signed BAA prior to October 12, 2015.

The Resolution Agreement and Corrective Action Plan may be found on the OCR Web site at: http://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/CCDH.

For more information on BAAs, visit: https://www.hhs.gov/hipaa/for-professionals/covered-entities/sample-business-associate-agreement-provisions/index.html.

To learn more about non-discrimination and health information privacy laws, civil rights, and privacy rights in health care and human service settings, and to find information on filing a complaint, visit OCR at: http://www.hhs.gov/hipaa/index.html.

All Blog Posts >

NYSDA Blog posts

USDOL Updates Resources for Employers on Employment Law Issues
The United States Department of Labor (USDOL) has issued four new resources for employers on em.
GAO Issues Report on Veterans Health Care
The United States Government Accountability Office (GAO) has issued a report on veterans health care.
NYSDOH Issues Hurricane Preparedness Guidance
The New York State Department of Health (NYSDOH) has issued its recommendations on hurricane prepare.