By using this site, you agree to the Privacy Policy and Terms of Use.
Accept
Health Works CollectiveHealth Works CollectiveHealth Works Collective
  • Health
    • Mental Health
  • Policy and Law
    • Global Healthcare
    • Medical Ethics
  • Medical Innovations
  • News
  • Wellness
  • Tech
Search
© 2023 HealthWorks Collective. All Rights Reserved.
Reading: Total Cost of a HIPAA Violation: 18.5 Million
Share
Notification Show More
Font ResizerAa
Health Works CollectiveHealth Works Collective
Font ResizerAa
Search
Follow US
  • About
  • Contact
  • Privacy
© 2023 HealthWorks Collective. All Rights Reserved.
Health Works Collective > eHealth > Medical Records > Total Cost of a HIPAA Violation: 18.5 Million
Medical Records

Total Cost of a HIPAA Violation: 18.5 Million

onlinetech
onlinetech
Share
4 Min Read
SHARE

Who: Blue Cross Blue Shield of Tennessee (BCBST)

Who was affected: Over 1 million members of the BCBST had their information stolen, including names, SSNs, diagnosis codes, birthdates and health plan IDs.

What: 57 unencrypted hard drives were stolen from a leased facility in Tennessee, out of a data storage closet. According to the resolution agreement, the BCBST were relocating staff from the facility and had not yet moved the servers from the closet to their new location.

Who: Blue Cross Blue Shield of Tennessee (BCBST)

More Read

7 Reasons You Need Digital Marketing For Your Medical Practice
The Iceberg Waiting for Your Health Care Data
More on Clinical Decison Support and EMRs
Critical Measures for Stopping Terrifying Hospital Data Breaches
How the Healthcare Industry Has Reduced Aggravation For Patients

Who was affected: Over 1 million members of the BCBST had their information stolen, including names, SSNs, diagnosis codes, birthdates and health plan IDs.

What: 57 unencrypted hard drives were stolen from a leased facility in Tennessee, out of a data storage closet. According to the resolution agreement, the BCBST were relocating staff from the facility and had not yet moved the servers from the closet to their new location.

Charged with: The OCR (Office of Civil Rights, official HIPAA-enforcement entity) found the BCBST failed to have ‘adaquate facility access controls,’ according to their press release. This put them in violation of implementing the appropriate physical safeguards as listed in the HIPAA Security Rule.

They were also found in violation of the administrative safeguards by failing to perform a security evaluation after operational changes.

What they could have done differently: Encrypt all data at rest, including their archived data stored on hard drives. This is a strongly recommended best practice for healthcare organizations that need to meet HIPAA compliance.

They also could have chosen to store their data in a secure, offsite location that had the appropriate physical safeguards/access controls, another important feature of HIPAA compliant data centers.

When: BCBST was alerted October 2, 2009 of an unresponsive server at the facility, but didn’t investigate until October 5, 2009. Official completion date of review, audit and affected individual notification was October 29, 2010.

How much did it cost them: Although the settlement case required BCBST to pay HHS 1.5 million, the company has spent nearly $17 million in investigation, notification and protection costs to date, bringing the total to 18.5 million. Affected individuals received free credit monitoring services, free identity monitoring, consultation, and restoration.

What are their next steps: BCBST encrypted all of its at-rest data, which they claim to be “a voluntary effort which goes above and beyond current industry standards.” While it might not be explicitly required by HIPAA standards, it’s pretty close (read Encrypting Data to Meet HIPAA Compliance for tips) :

A covered entity must, in accordance with §164.306… Implement a mechanism to encrypt and decrypt electronic protected health information.” (45 CFR § 164.312(a)(2)(iv))

BCBST entered a 450 day corrective action plan, which includes sending their written PHI security policies and procedures to HHS, monitoring their employees to ensure they’re trained and following HIPAA compliant policies and procedures, and conduct a risk management plan.

For more on HIPAA violations and the effects of data breaches, try reading How a HIPAA Breach Can Negatively Impact Your Business, or Sutter Health HIPAA Breach: Lessons Learned.

References:
HHS Resolution Agreement
BlueCross, HHS Reach Settlement in 2009 Hard Drive Data Theft
Eastgate Hard Drive Theft
HHS Settles HIPAA Case With BCBST for $1.5 Million

TAGGED:HIPAA violations
Share This Article
Facebook Copy Link Print
Share

Stay Connected

1.5kFollowersLike
4.5kFollowersFollow
2.8kFollowersPin
136kSubscribersSubscribe

Latest News

Nurse Scheduling Software
Evaluating 7 Best Nurse Scheduling Software
Nursing Technology
October 28, 2025
contamination
Batch Failures And The Hidden Costs Of Contamination
Health Infographics
October 21, 2025
Medication Management For Seniors
Simplifying Medication Management For Seniors
Infographics Senior Care
October 21, 2025
Guide To Pursuing a Career in Nursing as a Foreigner in the USA
Collaboration Is the Prescription for Better Patient Care
Health
October 20, 2025

You Might also Like

Medical Records

Interview/Podcast:HIT Interoperability with Cameron Deemer, President at DrFirst Pt. 1

February 20, 2012

SkinPut – A Touchscreen on Your Skin

March 3, 2011

The 5 Biggest Challenges Healthcare Leaders are Facing in 2015

August 5, 2015

5 Ways Healthcare Organizations Can Reduce Security Breaches

December 12, 2011
Subscribe
Subscribe to our newsletter to get our newest articles instantly!
Follow US
© 2008-2025 HealthWorks Collective. All Rights Reserved.
  • About
  • Contact
  • Privacy
Welcome Back!

Sign in to your account

Username or Email Address
Password

Lost your password?