Orthopedic clinic pays $750,000 to settle HIPAA charges
May 16, 2016
Raleigh, N.C. — A North Carolina orthopedic clinic has agreed to pay $750,000 to the federal government to settle charges that the clinic potentially violated the Health Insurance Portability and Accountability Act in 2013 by giving patient information to a potential business partner without an agreement.
Raleigh Orthopaedic Clinic., P.A., a group practice that operates clinics and an orthopaedic surgery center in the Raleigh area, did not have a business associate agreement with its potential business partner when it released the X-ray films and related protected health information of 17,300 patients to an entity that promised to transfer the images to electronic media in exchange for harvesting the silver from the X-ray films, according to a news release from the Office for Civil Rights.
In addition to the $750,000 payment, Raleigh Orthopaedic is required to revise its policies and procedures to: establish a process for assessing whether entities are business associates; designate an individual to ensure business associate agreements are in place prior to disclosing protected health information; create a standard template for business associate agreements; establish a standard process for maintaining documentation of a business associate agreements for at least six years beyond the date of termination of a business associate relationship; and limit disclosures of protected health information to any business associate to the minimum necessary to accomplish the purpose for which they were hired.