On Jan. 5 2018, Oklahoma State University Center for Health Science learned that malware had been installed on its server, allowing an unauthorized user to access the protected health information of 279,865 individuals, HHS said in a July 14 news release.
Names, Medicaid numbers, healthcare provider names, dates of service, dates of birth, addresses and treatment information were compromised in the breach, HHS said.
Oklahoma State University Center for Health Science initially declared that the data breach occurred on Nov. 7, 2017, however, it was later reported that the unauthorized user first had access to patient information on March 9, 2016.
The HHS Office for Civil Rights determined Oklahoma State University Center for Health Science had potentially violated the following provisions of HIPAA:
- Impermissible disclosure of the protected health information of 279,865 individuals
- Failure to conduct a comprehensive and accurate organizationwide risk analysis
- Failure to perform a periodic technical and nontechnical evaluation in response to environmental or operational changes affecting the security of protected health information
- Failure to implement audit controls
- A security incident response and reporting failure
- Failure to provide timely breach notification to affected individuals
- Failure to provide timely breach notification to the secretary of the HHS.
In addition to the financial penalty, Oklahoma State University Center for Health Science has agreed to implement a corrective action plan to resolve all areas of noncompliance identified by its civil right office and has promised to closely monitor its plan for compliance.
At the Becker's 11th Annual IT + Revenue Cycle Conference: The Future of AI & Digital Health, taking place September 14–17 in Chicago, healthcare executives and digital leaders from across the country will come together to explore how AI, interoperability, cybersecurity, and revenue cycle innovation are transforming care delivery, strengthening financial performance, and driving the next era of digital health. Apply for complimentary registration now.