A group of five Cadia Healthcare rehabilitation, skilled nursing and long-term care facilities in Delaware have agreed to a settlement with HHS in relation to potential HIPAA violations of 150 patients.
The settlement stems from a 2021 HHS investigation that found that the facilities had disclosed patient health information on facility websites in the form of “success stories,” according to a Sept. 30 news release from HHS.
Kennett Square, Pa.-based Cadia Healthcare has agreed to a two-year, Office for Civil Rights-monitored corrective action plan and has paid $182,000 to the agency, the release said.
In a statement, Cadia Healthcare said it learned on Feb. 22, 2022, of one or more instances in which Cadia employees had shared patient success stories without obtaining written consent, as pursuant with the organization’s policies and procedures. After an internal investigation, Cadia removed all success story social media posts and eliminated the success story program.
“We have taken this matter very seriously, and we apologize for any inconvenience or concern this may have caused,” the statement said. “We have since enhanced our privacy policies and procedures, as well as increased awareness of these policies and procedures through additional employee training, to help prevent something like this from happening again.”
At the Becker's 11th Annual IT + Revenue Cycle Conference: The Future of AI & Digital Health, taking place September 14–17 in Chicago, healthcare executives and digital leaders from across the country will come together to explore how AI, interoperability, cybersecurity, and revenue cycle innovation are transforming care delivery, strengthening financial performance, and driving the next era of digital health. Apply for complimentary registration now.