HIPAA Round-Up: Feds Ramp Up Enforcement Post-PHE

Why This Topic Matters

The roundup helps organizations gauge current enforcement priorities and identify recurring compliance risk areas that may affect privacy and security programs. It is useful for readers reviewing policies, training, vendor oversight, and incident-response practices in the post-PHE environment.

Article Sections

1. Right of Access

   This section covers an OCR settlement involving delayed patient record access and a corrective action plan. It places the matter in the context of the agency’s broader access-focused enforcement activity.

2. Unlawful disclosure

   This section summarizes a settlement involving an unsecured server, business associate oversight, and privacy and security rule concerns. It emphasizes the compliance implications for vendors and their contracting relationships.

3. Social media

   This section discusses a complaint arising from a provider’s online response to a negative review and the resulting enforcement action. It highlights the growing visibility of internet- and social-media-related privacy complaints.

4. Workforce

   This section addresses insider access to patient information by hospital security personnel and the resulting settlement. It focuses on workforce conduct and related compliance monitoring.

5. Impermissible disclosure

   This section reviews another breach-related settlement involving a vendor server and related security-rule concerns. It reinforces the importance of organizational risk analysis and data protection practices.