HIPAA Violation

In 2019, the University of Rochester Medical Center (URMC) waspenalized $3,000,000 for failure to meet the HIPAA security rulerequirements. The personal laptop of a resident was stolen. This laptopcontained unencrypted ePHI. Investigation of the incident by HHSresulted in a number of violations:

Failure to implement appropriate policies and procedures to protecthardware and other electronic media, and share policies and procedureswith the workforce.

HHS developed a corrective action plan which would last for twoyears. During this time URMC had to conduct a risk analysis, develop andimplement a risk management plan, implement HHS’s recommendations,develop policies and procedures related to risk analysis and riskmanagement, report failures, and more, URMC had to submit a reportwithin 120 days and submit annual reports. Source: HHS 2019b

• Do you believe the $3,000,000 penalty is excessive? Justify your stance.
• Identify steps that the hospital can take to improve its security program.