{"id":2394,"date":"2013-04-17T00:00:00","date_gmt":"2013-04-17T00:00:00","guid":{"rendered":"http:\/\/otava.test\/healthcare-data-breach-means-prison-time-class-action-lawsuit\/"},"modified":"2013-04-17T00:00:00","modified_gmt":"2013-04-17T00:00:00","slug":"healthcare-data-breach-means-prison-time-class-action-lawsuit","status":"publish","type":"post","link":"https:\/\/www.otava.com\/blog\/healthcare-data-breach-means-prison-time-class-action-lawsuit\/","title":{"rendered":"Healthcare Data Breach Leads to Prison Time; Class Action Lawsuit"},"content":{"rendered":"

For two years, a former emergency department worker of Florida Hospital Celebration gained unauthorized access to more than 763,000 electronic patient health records and sold 12,000 of them to a co-conspirator (and operator of two chiropractic centers) to solicit patients for legal and chiropractic services. While they may have viewed this as a way to quickly gain a network of potential clients, the HIPAA Privacy Rule<\/a> dictates that they clearly accessed ePHI<\/a> inappropriately and misused the data by selling it.<\/p>\n

The insider threat means covered entities and business associates have to stay vigilant by monitoring and investigating any suspicious activity. From a technical perspective, daily log review<\/a> is a service that involves monitoring, analyzing and reporting on user and system activity to help detect patterns of normal use and pinpoint potentially malicious users.<\/p>\n

\"Daily
Daily Log Review<\/figcaption><\/figure>\n

Another technical service<\/a> to help monitor your files and systems is file integrity monitoring<\/a> (FIM), which can directly alert you of any anomalies and tell you when a file is altered or destroyed. FIM is recommended to help meet HIPAA compliance, as it can satisfy the HIPAA standard \u00a7164.312(b) that requires covered entities and business associates to:<\/p>\n

\n

Implement hardware, software and\/or procedural mechanisms that record and examine activity in information systems that contain or use electronic protected health information.<\/p>\n<\/blockquote>\n

\"File
File Integrity Monitoring (FIM)<\/figcaption><\/figure>\n

Since the Florida hospital is part of a 37 hospital network under Adventist Health System, the system now faces a class action lawsuit as a result of the data breach with affected individuals seeking damages for failing to secure ePHI (the former worker has been sentenced to a year in federal prison).<\/p>\n

The lawsuit points out that employees that weren\u2019t authorized to access the information were, in fact, able to with only log-in credentials; they permitted to share credentials; and their logins were allowed to be used to access multiple computers at the same time from multiple locations. It also maintains that they failed to train and monitor its employees\u2019 access to sensitive information, according to HealthCareInfoSecurity.com<\/p>\n

And it claims the hospital\u2019s failure to segment and control its database in compliance with the HIPAA security regulations and industry standards fell short of its promises in patient agreements and privacy policies, according to the lawsuit document. While proper policies and procedures<\/a> are an important aspect of meeting the administrative security standards of HIPAA compliance, they don\u2019t really matter unless an organization\u2019s employees are aware and abide by them. Policies should meet the HIPAA Security Rule<\/a>\u2019s organizational, policies and procedures documentation requirements, \u00a7164.316(a):<\/p>\n

\n

Implement reasonable and appropriate policies and procedures to comply with the standards, implementation specifications, or other requirements of this subpart, taking into account those factors specified in \u00a7 164.306(b)(2)(i), (ii), (iii), and (iv) [the Security Standards: General Rules, Flexibility of Approach].<\/p>\n

This standard is not to be construed to permit or excuse an action that violates any other standard, implementation specification, or other requirements of this subpart.<\/p>\n

A covered entity may change its policies and procedures at any time, provided that the changes are documented and are implemented in accordance with this subpart.<\/p>\n<\/blockquote>\n

Staff training<\/a> is also required by the security awareness and training standard of the Administrative Safeguards required by the HIPAA Security Rule, 164.308(a)(5):<\/p>\n

\n

Implement a security awareness and training program for all members of its workforce (including management).<\/p>\n<\/blockquote>\n

The lesson learned here is that one employee at one hospital can cause a significantly costly and messy legal case for the health system at large, if they fail to meet HIPAA compliance – people go to jail, legislation gets drawn out for years, and loss of credibility can deter the most loyal consumers. A wake-up call to healthcare CIOs, the technical, administrative and physical safeguards required by HIPAA are worth the ongoing investment if they wish to avoid the consequences of a data breach.<\/p>\n

Find out how you can ensure your hosting solution (colocation<\/a>, managed servers<\/a>, cloud<\/a>) is HIPAA compliant by reading our HIPAA Compliant Hosting white paper<\/a>.<\/p>\n

Related Articles:
\nOvercoming Healthcare CIO Challenges with Secure & Scalable HIPAA Hosting<\/a><\/em>
\n HHS Wall of Shame: Forty Percent of 2013 HIPAA Breaches Involved Business Associates<\/a><\/em>
\n HIPAA Breach Lessons Learned: Store PHI in HIPAA Compliant Data Centers; Not Locally<\/a><\/em><\/p>\n

References:
\nHealth Data Theft Case Prompts Lawsuits<\/a>
\nPrison Time for Health Data Theft<\/a>
\nClass Action Complaint: Richard Faircloth vs. Adventist Health System<\/a> (PDF)<\/p>\n","protected":false},"excerpt":{"rendered":"

For two years, a former emergency department worker of Florida Hospital Celebration gained unauthorized access to more than 763,000 electronic patient health records and sold 12,000 of them to a co-conspirator (and operator of two chiropractic centers) to solicit patients for legal and chiropractic services. While they may have viewed this as a way to quickly gain a network of potential clients, the HIPAA Privacy Rule dictates that they clearly accessed ePHI inappropriately and misused the data by selling it. The insider threat means covered entities and business associates have to stay vigilant by monitoring and investigating any suspicious activity. From a technical perspective, daily log review is a service that involves monitoring, analyzing and reporting on user and system activity to help detect patterns of normal use and pinpoint potentially malicious users. Another technical service to help monitor your files and systems is file integrity monitoring (FIM), which can directly alert you of any anomalies and tell you when a file is altered or destroyed. FIM is recommended to help meet HIPAA compliance, as it can satisfy the HIPAA standard \u00a7164.312(b) that requires covered entities and business associates to: Implement hardware, software and\/or procedural mechanisms that record and examine…<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[],"other_category":[],"class_list":["post-2394","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"acf":[],"yoast_head":"\nHealthcare Data Breach Leads to Prison Time; Class Action Lawsuit | OTAVA<\/title>\n<meta name=\"description\" content=\"For two years, a former worker of Florida Hospital Celebration gained unauthorized access to more than 763,000 electronic patient health records.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.otava.com\/blog\/healthcare-data-breach-means-prison-time-class-action-lawsuit\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Healthcare Data Breach Leads to Prison Time; Class Action Lawsuit\" \/>\n<meta property=\"og:description\" content=\"For two years, a former worker of Florida Hospital Celebration gained unauthorized access to more than 763,000 electronic patient health records.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.otava.com\/blog\/healthcare-data-breach-means-prison-time-class-action-lawsuit\/\" \/>\n<meta property=\"og:site_name\" content=\"OTAVA\" \/>\n<meta property=\"article:published_time\" content=\"2013-04-17T00:00:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.otava.com\/wp-content\/uploads\/2019\/04\/log-monitoring-diagram.png\" \/>\n<meta name=\"author\" content=\"Irma Brillantes\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Irma Brillantes\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.otava.com\/blog\/healthcare-data-breach-means-prison-time-class-action-lawsuit\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.otava.com\/blog\/healthcare-data-breach-means-prison-time-class-action-lawsuit\/\"},\"author\":{\"name\":\"Irma Brillantes\",\"@id\":\"https:\/\/www.otava.com\/#\/schema\/person\/35774075f8f4fcdd4eae80cb72034263\"},\"headline\":\"Healthcare Data Breach Leads to Prison Time; Class Action Lawsuit\",\"datePublished\":\"2013-04-17T00:00:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.otava.com\/blog\/healthcare-data-breach-means-prison-time-class-action-lawsuit\/\"},\"wordCount\":746,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/www.otava.com\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.otava.com\/blog\/healthcare-data-breach-means-prison-time-class-action-lawsuit\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.otava.com\/wp-content\/uploads\/2019\/04\/log-monitoring-diagram.png\",\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.otava.com\/blog\/healthcare-data-breach-means-prison-time-class-action-lawsuit\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.otava.com\/blog\/healthcare-data-breach-means-prison-time-class-action-lawsuit\/\",\"url\":\"https:\/\/www.otava.com\/blog\/healthcare-data-breach-means-prison-time-class-action-lawsuit\/\",\"name\":\"Healthcare Data Breach Leads to Prison Time; Class Action Lawsuit | OTAVA\",\"isPartOf\":{\"@id\":\"https:\/\/www.otava.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.otava.com\/blog\/healthcare-data-breach-means-prison-time-class-action-lawsuit\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.otava.com\/blog\/healthcare-data-breach-means-prison-time-class-action-lawsuit\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.otava.com\/wp-content\/uploads\/2019\/04\/log-monitoring-diagram.png\",\"datePublished\":\"2013-04-17T00:00:00+00:00\",\"description\":\"For two years, a former worker of Florida Hospital Celebration gained unauthorized access to more than 763,000 electronic patient health records.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.otava.com\/blog\/healthcare-data-breach-means-prison-time-class-action-lawsuit\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.otava.com\/blog\/healthcare-data-breach-means-prison-time-class-action-lawsuit\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.otava.com\/blog\/healthcare-data-breach-means-prison-time-class-action-lawsuit\/#primaryimage\",\"url\":\"https:\/\/www.otava.com\/wp-content\/uploads\/2019\/04\/log-monitoring-diagram.png\",\"contentUrl\":\"https:\/\/www.otava.com\/wp-content\/uploads\/2019\/04\/log-monitoring-diagram.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.otava.com\/blog\/healthcare-data-breach-means-prison-time-class-action-lawsuit\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.otava.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Healthcare Data Breach Leads to Prison Time; Class Action Lawsuit\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.otava.com\/#website\",\"url\":\"https:\/\/www.otava.com\/\",\"name\":\"OTAVA\u00ae\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/www.otava.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.otava.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.otava.com\/#organization\",\"name\":\"OTAVA\u00ae\",\"url\":\"https:\/\/www.otava.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.otava.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.otava.com\/wp-content\/uploads\/2025\/03\/otava-logo.svg\",\"contentUrl\":\"https:\/\/www.otava.com\/wp-content\/uploads\/2025\/03\/otava-logo.svg\",\"caption\":\"OTAVA\u00ae\"},\"image\":{\"@id\":\"https:\/\/www.otava.com\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.otava.com\/#\/schema\/person\/35774075f8f4fcdd4eae80cb72034263\",\"name\":\"Irma Brillantes\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/secure.gravatar.com\/avatar\/d5251bebc1699793a698d1a6158603cb3cdc50a095a12357e42d415b3e5546c2?s=96&d=mm&r=g\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/d5251bebc1699793a698d1a6158603cb3cdc50a095a12357e42d415b3e5546c2?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/d5251bebc1699793a698d1a6158603cb3cdc50a095a12357e42d415b3e5546c2?s=96&d=mm&r=g\",\"caption\":\"Irma Brillantes\"},\"url\":\"https:\/\/www.otava.com\/blog\/author\/ibrillantesotava-com\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Healthcare Data Breach Leads to Prison Time; Class Action Lawsuit | OTAVA","description":"For two years, a former worker of Florida Hospital Celebration gained unauthorized access to more than 763,000 electronic patient health records.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.otava.com\/blog\/healthcare-data-breach-means-prison-time-class-action-lawsuit\/","og_locale":"en_US","og_type":"article","og_title":"Healthcare Data Breach Leads to Prison Time; Class Action Lawsuit","og_description":"For two years, a former worker of Florida Hospital Celebration gained unauthorized access to more than 763,000 electronic patient health records.","og_url":"https:\/\/www.otava.com\/blog\/healthcare-data-breach-means-prison-time-class-action-lawsuit\/","og_site_name":"OTAVA","article_published_time":"2013-04-17T00:00:00+00:00","og_image":[{"url":"https:\/\/www.otava.com\/wp-content\/uploads\/2019\/04\/log-monitoring-diagram.png","type":"","width":"","height":""}],"author":"Irma Brillantes","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Irma Brillantes","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.otava.com\/blog\/healthcare-data-breach-means-prison-time-class-action-lawsuit\/#article","isPartOf":{"@id":"https:\/\/www.otava.com\/blog\/healthcare-data-breach-means-prison-time-class-action-lawsuit\/"},"author":{"name":"Irma Brillantes","@id":"https:\/\/www.otava.com\/#\/schema\/person\/35774075f8f4fcdd4eae80cb72034263"},"headline":"Healthcare Data Breach Leads to Prison Time; Class Action Lawsuit","datePublished":"2013-04-17T00:00:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.otava.com\/blog\/healthcare-data-breach-means-prison-time-class-action-lawsuit\/"},"wordCount":746,"commentCount":0,"publisher":{"@id":"https:\/\/www.otava.com\/#organization"},"image":{"@id":"https:\/\/www.otava.com\/blog\/healthcare-data-breach-means-prison-time-class-action-lawsuit\/#primaryimage"},"thumbnailUrl":"https:\/\/www.otava.com\/wp-content\/uploads\/2019\/04\/log-monitoring-diagram.png","inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.otava.com\/blog\/healthcare-data-breach-means-prison-time-class-action-lawsuit\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.otava.com\/blog\/healthcare-data-breach-means-prison-time-class-action-lawsuit\/","url":"https:\/\/www.otava.com\/blog\/healthcare-data-breach-means-prison-time-class-action-lawsuit\/","name":"Healthcare Data Breach Leads to Prison Time; Class Action Lawsuit | OTAVA","isPartOf":{"@id":"https:\/\/www.otava.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.otava.com\/blog\/healthcare-data-breach-means-prison-time-class-action-lawsuit\/#primaryimage"},"image":{"@id":"https:\/\/www.otava.com\/blog\/healthcare-data-breach-means-prison-time-class-action-lawsuit\/#primaryimage"},"thumbnailUrl":"https:\/\/www.otava.com\/wp-content\/uploads\/2019\/04\/log-monitoring-diagram.png","datePublished":"2013-04-17T00:00:00+00:00","description":"For two years, a former worker of Florida Hospital Celebration gained unauthorized access to more than 763,000 electronic patient health records.","breadcrumb":{"@id":"https:\/\/www.otava.com\/blog\/healthcare-data-breach-means-prison-time-class-action-lawsuit\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.otava.com\/blog\/healthcare-data-breach-means-prison-time-class-action-lawsuit\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.otava.com\/blog\/healthcare-data-breach-means-prison-time-class-action-lawsuit\/#primaryimage","url":"https:\/\/www.otava.com\/wp-content\/uploads\/2019\/04\/log-monitoring-diagram.png","contentUrl":"https:\/\/www.otava.com\/wp-content\/uploads\/2019\/04\/log-monitoring-diagram.png"},{"@type":"BreadcrumbList","@id":"https:\/\/www.otava.com\/blog\/healthcare-data-breach-means-prison-time-class-action-lawsuit\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.otava.com\/"},{"@type":"ListItem","position":2,"name":"Healthcare Data Breach Leads to Prison Time; Class Action Lawsuit"}]},{"@type":"WebSite","@id":"https:\/\/www.otava.com\/#website","url":"https:\/\/www.otava.com\/","name":"OTAVA\u00ae","description":"","publisher":{"@id":"https:\/\/www.otava.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.otava.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.otava.com\/#organization","name":"OTAVA\u00ae","url":"https:\/\/www.otava.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.otava.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.otava.com\/wp-content\/uploads\/2025\/03\/otava-logo.svg","contentUrl":"https:\/\/www.otava.com\/wp-content\/uploads\/2025\/03\/otava-logo.svg","caption":"OTAVA\u00ae"},"image":{"@id":"https:\/\/www.otava.com\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.otava.com\/#\/schema\/person\/35774075f8f4fcdd4eae80cb72034263","name":"Irma Brillantes","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/d5251bebc1699793a698d1a6158603cb3cdc50a095a12357e42d415b3e5546c2?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/d5251bebc1699793a698d1a6158603cb3cdc50a095a12357e42d415b3e5546c2?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d5251bebc1699793a698d1a6158603cb3cdc50a095a12357e42d415b3e5546c2?s=96&d=mm&r=g","caption":"Irma Brillantes"},"url":"https:\/\/www.otava.com\/blog\/author\/ibrillantesotava-com\/"}]}},"_links":{"self":[{"href":"https:\/\/www.otava.com\/wp-json\/wp\/v2\/posts\/2394","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.otava.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.otava.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.otava.com\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.otava.com\/wp-json\/wp\/v2\/comments?post=2394"}],"version-history":[{"count":0,"href":"https:\/\/www.otava.com\/wp-json\/wp\/v2\/posts\/2394\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.otava.com\/wp-json\/wp\/v2\/media?parent=2394"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.otava.com\/wp-json\/wp\/v2\/categories?post=2394"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.otava.com\/wp-json\/wp\/v2\/tags?post=2394"},{"taxonomy":"other_category","embeddable":true,"href":"https:\/\/www.otava.com\/wp-json\/wp\/v2\/other_category?post=2394"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}