Jackson Health System in Miami faces $2.15 million penalty for privacy violations
November 05, 2019
The Office for Civil Rights announced Oct. 23 that it imposed a $2.15 billion civil money penalty against Jackson Health System in Miami for violations of the Health Insurance Portability and Accountability Act.
JHS submitted a breach report to OCR in August 2013, stating it had lost paper records containing protected health information of 756 patients in January 2013. JHS determined three boxes containing additional patient records were lost in December 2012, although it did not report this discovery to OCR until June 2016.
In July 2015, a reporter posted a photograph on social media of a JHS operating room screen containing a patient’s medical information. OCR subsequently initiated an investigation into JHS. JHS reported to OCR in February, 2016 that an employee inappropriately accessed over 24,000 patient records since 2011 and had been selling the information.
OCR determined that JHS failed to conduct enterprise-wide risk analyses, regularly review information system activity records, adequately restrict workforce access to protected health information and provide timely and accurate breach notification to the secretary of the Department of Health and Human Services.
JHS did not contest the findings and paid the penalty in full.