The 210-bed assisted living facility, now known as Adara Living, discovered two employee emails had been compromised in March 2021. Tens of thousands of emails in those accounts contained personal, financial and medical data dating back to 2016.
The attorney general’s office alleged the facility did not have a paper or electronic data disposal policy in place and accused it of waiting months before notifying affected patients, instead of notifying them within 30 days as required by law.
In the settlement, Broomfield agreed to pay between $35,000 and $60,000, to develop a disposal policy and an incident response plan, to update its information security system and to review the safeguards annually and submit compliance reports.
At the Becker's 11th Annual IT + Revenue Cycle Conference: The Future of AI & Digital Health, taking place September 14–17 in Chicago, healthcare executives and digital leaders from across the country will come together to explore how AI, interoperability, cybersecurity, and revenue cycle innovation are transforming care delivery, strengthening financial performance, and driving the next era of digital health. Apply for complimentary registration now.
