A complaint filed one week before the settlement was announced claimed that two former UMass Memorial employees improperly accessed patients’ personal and protected health information for fraudulent purposes. Patients’ names, addresses, Social Security numbers, clinical data and health insurance information had been exposed.
The state Attorney General’s Office claimed the hospital violated HIPAA, as well as the Consumer Protection Act and the Massachusetts Data Security Law, when it allegedly failed to adequately protect patient data. Specifically, the complaint alleges the hospital was aware of its employees’ misconduct, but that it didn’t investigate the incidents or take action against the employees involved.
“Massachusetts residents rely on their healthcare providers to keep private health information safe and secure,” Attorney General Maura Healey said in a news release. “This resolution ensures UMass Memorial implements important measures to prevent this type of breach from happening again.”
More articles on legal and regulatory issues:
Illinois Supreme Court: Hospitals’ property tax exemption is constitutional
3 Boston hospitals fined nearly $1M for letting ‘Boston Trauma’ film on-site, breaching HIPAA
350+ patients settle lawsuit with Pennsylvania hospital over fugitive physician’s misdiagnoses
At the Becker's 11th Annual IT + Revenue Cycle Conference: The Future of AI & Digital Health, taking place September 14–17 in Chicago, healthcare executives and digital leaders from across the country will come together to explore how AI, interoperability, cybersecurity, and revenue cycle innovation are transforming care delivery, strengthening financial performance, and driving the next era of digital health. Apply for complimentary registration now.