Reference no: EM133265841

Case: In 2014, the Department of Health and Human Services reported on its website a $4.8 million HIPAA settlement with New York and Presbyterian Hospital (NYP) and Columbia University following the 2010 breach of thousands of patients' e-PHI. A Columbia University physician, who was an attending physician at NYP, tried to deactivate a computer server that he owned on the network that contained NYP patient e-PHI. The e-PHI became accessible to the public on Internet search engines because technical safeguards were lacking. A patient's loved one found e-PHI about the patient on the Internet and filed a complaint.

In addition to the impermissible disclosure, both entities were noncompliant in other ways: (1) no attempts had been made to assure the server was secure; (2) a thorough risk analysis had never been completed that identified all systems able to access the e-PHI of NYP patients and therefore no plan to address potential threats and hazards existed; (3) no appropriate policies and procedures existed regarding authorizing access to its databases; and (4) they did not follow their own policies on information access management (HHS 2014).
This costly mistake, both monetarily and from a reputation standpoint, highlights the negative outcomes that can happen when both technical and administrative safeguards are not followed. It also emphasizes the importance of inventorying all systems and devices that can access an organization's e-PHI to address threats and an organization's vulnerabilities. This is not an easy task given the number of personal and mobile devices that access e-PHI, but it is critical.

Question 1. A risk analysis should include an inventory of all systems and devices that can access an organization's ePHI (in this case, the breach occurred via a physician's personal computer server). How can an organization account for all systems and devices on which PHI may be accessed or otherwise present?

Question 2. What should the risk analysis include?

Question 3. Should the physician have been the one to deactivate the server? Why or why not?