The OCR began investigating Dr. Porter’s practice after he filed a notice of a data breach due to a dispute with a business associate. After an investigation, the OCR determined that Dr. Porter failed to conduct a risk analysis when the breach was reported.
Additionally, although Dr. Porter had significant technical assistance through the investigation, he never implemented security measures sufficient to reduce risks and vulnerabilities.
“All healthcare providers, large and small, need to take their HIPAA obligations seriously,” said OCR Director Roger Severino. “The failure to implement basic HIPAA requirements, such as an accurate and thorough risk analysis and risk management plan, continues to be an unacceptable and disturbing trend within the healthcare industry.”
Along with paying $100,000, Dr. Porter agreed to complete a corrective action plan, which includes two years of monitoring.
More articles on cybersecurity:
Texas provider alerts 6,500 patients of phishing attack
Connecticut payer alerts 1,100 members of phishing attack
10 tips for hospitals to mitigate ransomware attacks
At the Becker's 11th Annual IT + Revenue Cycle Conference: The Future of AI & Digital Health, taking place September 14–17 in Chicago, healthcare executives and digital leaders from across the country will come together to explore how AI, interoperability, cybersecurity, and revenue cycle innovation are transforming care delivery, strengthening financial performance, and driving the next era of digital health. Apply for complimentary registration now.