Alaska’s State Medicaid agency (the “Agency”), has agreed to pay the U.S. Department of Health and Human Services’ (“HHS”) $1,700,000 to settle potential violations of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). Alaska has also agreed to take corrective action to properly safeguard the electronic protected health information (“ePHI”).
The HHS Office for Civil Rights (“OCR”) began its investigation following a breach of ePHI. The breach was the result of the loss of a USB drive possibly containing ePHI. Over the course of the investigation, OCR found that the Agency did not have adequate policies and procedures in place to safeguard ePHI. Further, the Agency had not completed a risk analysis, implemented sufficient risk management measures, completed security training for its workforce members, implemented device and media controls, or addressed device and media encryption as required by the HIPAA Security Rule.
