Photocopier Hard Drives Cause Breach Yielding $1.2 Million HIPAA Settlement

On August 14, 2013, the Office of Civil Rights for the U.S. Department of Health and Human Services ("HHS OCR") announced a $1.2 million settlement with Affinity Health Plan for violations of the privacy and security rules under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"). According to the HHS OCR press release, the violation arose when Affinity disposed of photocopiers with built-in hard drives which still contained images of patient records that had been photocopied on the devices:

Affinity filed a breach report with the HHS Office for Civil Rights (OCR) on April 15, 2010, as required by the Health Information Technology for Economic and Clinical Health, or HITECH Act. The HITECH Breach Notification Rule requires HIPAA-covered entities to notify HHS of a breach of unsecured protected health information. Affinity indicated that it was informed by a representative of CBS Evening News that, as part of an investigatory report, CBS had purchased a photocopier previously leased by Affinity. CBS informed Affinity that the copier that Affinity had used contained confidential medical information on the hard drive.

Afinity estimated that up to 344,579 individuals may have been affected by this breach. OCR’s investigation indicated that Affinity impermissibly disclosed the protected health information of these affected individuals when it returned multiple photocopiers to leasing agents without erasing the data contained on the copier hard drives. In addition, the investigation revealed that Affinity failed to incorporate the electronic protected health information (ePHI) stored on photocopier hard drives in its analysis of risks and vulnerabilities as required by the Security Rule, and failed to implement policies and procedures when returning the photocopiers to its leasing agents.

The Affinity resolution agreement may be downloaded here.

Beyond the substantial size and number of individuals' records involved in this case, it is notable that the breach in question was from a device not typically thought of as prone to privacy problems: a photocopier with an internal hard drive. Most users don't consider the built-in storage in printers and photocopiers, but these devices can and do retain previously printed and scanned information. The FTC and NIST offer useful information for organizations on improving security and privacy of digital printers and copiers.

HIPAA De-Identification Guidance from HHS OCR

The Office of Civil Rights ("OCR") of the U.S. Department of Health and Human Services recently issued guidance for appropriate ways to de-identify (remove personally identifiable information from) electronically stored health records. De-identification is required by the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") Privacy Rule in order to permit scientific analyses and other publicly beneficial uses of health records without violating the privacy of the patients whose health information is being shared for analysis. Section 164.514(b) of the HIPAA privacy rule provides two methods for de-identification: Expert Determination and the so-called "Safe Harbor."

It can be challenging, though, to completely de-identify any health information, since those with other sources of information may be able to combine those databases with the de-identified data to "re-identify" individual patients. (In a non-health context, this was demonstrated in 2006 after AOL released a supposedly anonymized search query database of its users, and reporters were able to positively identify at least one user by her particular searches.) With its latest guidance (which can be downloaded here), OCR answers questions about the use and limitations of its approved de-identification methods.

(via IAPP)