Cybersecurity Policy Report, Medical Record Data Breach Leads to Fine for Health Care Provider, (May 29, 2025)
Organizations Mentioned:Baycare Health System
The U.S. Department of Health and Human Services’ Office for Civil Rights (OCR) has entered into a settlement with Florida health care provider BayCare Health System, resolving alleged violations of the Health Insurance Portability and Accountability Act (HIPAA) security rule, OCR announced yesterday.
The OCR began an investigation after it received a complaint alleging that, after the complainant received treatment at a BayCare facility, she was contacted by an unknown individual with photos of her printed medical records and a video of someone scrolling through her medical records on a computer screen. The OCR determined the credentials used to access the complainant’s medical records belonged to a former non-clinical staff member of a physician’s practice, which had access to BayCare’s electronic medical records.
The OCR determined that BayCare potentially violated multiple requirements of the HIPAA security rule, including (1) failure to implement policies and procedures for authorizing access to electronic protected health information (ePHI) consistent with the applicable requirements of the HIPAA privacy rule; (2) failure to reduce risks and vulnerabilities to ePHI to a reasonable and appropriate level; and (3) failure to regularly review records of information system activity.
The settlement requires BayCare to implement a corrective action plan, to pay OCR $800,000, and to take steps to resolve its potential HIPAA security rule violations. The settlement also requires BayCare to protect the privacy and security of ePHI by, among other things, conducting a thorough risk analysis to determine potential risks and vulnerabilities to the confidentiality, integrity, and availability of its ePHI.
News: FederalLegislation LitigationEnforcement DataPrivacy DataSecurity