Privacy & Information Security Law Blog

On June 13, 2013, the Department of Health and Human Services (“HHS”) announced a resolution agreement and $275,000 settlement with Shasta Regional Medical Center (“Shasta”) that pertained to impermissible disclosures of protected health information (“PHI”) by Shasta officials to the media, as well as to Shasta’s entire workforce.

In late 2011, Shasta officials disclosed detailed information about a patient’s medical treatment to three separate media outlets without the patient’s authorization. In addition, Shasta distributed an email to its entire workforce of approximately 800-900 individuals that described the patient’s medical condition and treatment, also without the patient’s authorization. Shasta officials failed to sanction any of its workforce members for these impermissible disclosures of PHI in violation of the HIPAA Privacy Rule.

Pursuant to the resolution agreement, Shasta has agreed to pay a $275,000 settlement to HHS. In addition, the Corrective Action Plan attached to the resolution agreement requires Shasta to:

• develop policies and procedures that comply with the HIPAA Privacy Rule and that must specifically address permissible and impermissible uses and disclosures of PHI, how workforce members should communicate with the media regarding patient-related inquires, and how PHI should be shared within Shasta;
• distribute these policies and procedures to its workforce and require written or electronic certification that all workforce members will comply with them;
• investigate and report any violations of the HIPAA policies and procedures to HHS; and
• conduct training for its workforce.

In announcing the settlement, the Director of the HHS Office for Civil Rights Leon Rodriguez noted that Shasta’s senior management had “intentionally and repeatedly” violated the HIPAA Privacy Rule and stated that “OCR will respond quickly and decisively to stop such behavior.” The Shasta settlement marks the second enforcement action taken by OCR in 2013, following a May 2013 settlement with Idaho State University.