The United States Office for Civil Rights (OCR) has taken action against the Center for Children’s Digestive Health (CCDH) for violations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) that included failing to have a HIPAA business associate agreement (BAA) in place with a company that stored patient information for CCDH. The action is interesting in that it exclusively focuses on the HIPAA obligations to have appropriate BAAs in place. You can read the OCR announcement and summary of its action against CCDH below, with links to the complete Resolution Agreement and OCR guidance on HIPAA BAAs.
April 20, 2017
No Business Associate Agreement? $31K Mistake
The Center for Children’s Digestive Health (CCDH) has paid the United States Office for Civil Rights (OCR) $31,000 to settle potential violations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule and agreed to implement a corrective action plan. CCDH is a small, for-profit health care provider with a pediatric subspecialty practice that operates its practice in seven clinic locations in Illinois.
In August 2015, OCR initiated a compliance review of CCDH following an initiation of an investigation of a business associate, FileFax, Inc., which stored records containing protected health information (PHI) for CCDH. While CCDH began disclosing PHI to Filefax in 2003, neither party could produce a signed BAA prior to October 12, 2015.
The Resolution Agreement and Corrective Action Plan may be found on the OCR Web site at: http://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/CCDH.
For more information on BAAs, visit: https://www.hhs.gov/hipaa/for-professionals/covered-entities/sample-business-associate-agreement-provisions/index.html.
To learn more about non-discrimination and health information privacy laws, civil rights, and privacy rights in health care and human service settings, and to find information on filing a complaint, visit OCR at: http://www.hhs.gov/hipaa/index.html.