Breach of Unsecured Server Results in Monetary Penalty and Corrective Action Plan

Although the penalty of $25,000 assessed by DHHS is relatively low, the Resolution Agreement contains a number of corrective action obligations the provider must undertake, including, but not limited to, (i) sending breach notification to the affected individuals, the media and DHHS; (ii) conducting a complete and accurate risk assessment of the provider’s systems, with the scope and methodology of such risk assessment pre-approved by DHHS; (iii) conducting annual risk assessments; (iv) developing risk management plans based on the results of the risk assessments; (v) developing and revising the provider’s HIPAA policies and procedures and submitting them to DHHS for review and approval; (vi) distributing the final policies and procedures to the provider’s workforce and obtaining compliance certifications; (vii) training workforce members; and (viii) submitting an implementation report and annual reports to DHHS during the corrective action period.

The resolution of this breach event demonstrates that, although there is a financial and human resources cost to proper and full implementation of the requirements of HIPAA, the cost of a breach event, even one with a low monetary penalty, can be extremely high.

Click Here to read the entire June 2025 Healthcare Law Update now!