Cybersecurity Policy Report, SETTLEMENT AGREEMENTS: Violations of HIPAA Security Rule result in $350k settlement, (Apr 11, 2025)

By Patricia K. Ruiz, J.D.

OCR found the company failed to conduct an accurate and thorough risk analysis to determine potential risks and vulnerabilities in its information systems.

The HHS Office for Civil Rights (OCR) entered into a $350,000 settlement with Northeast Radiology, P.C. (NERAD), a professional corporation providing clinical services at medical imaging centers in New York and Connecticut. The settlement resolves alleged violations of the Health Insurance Portability and Accountability Act (HIPAA) Security Rule (Resolution Agreement, Jan. 6, 2025).

Under the HIPAA Security Rule, regulated organizations—covered entities and business associates—are required to conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI held by that organization.

Investigation. The settlement resolves an investigation concerning a breach of ePHI stored on NERAD’s Picture Archiving and Communication System (PACS) server for storing, retrieving, managing, and accessing radiology images. OCR initiated its investigation into NERAD after it received a breach report from the company of a breach of unsecured ePHI. NERAD reported that unauthorized individuals had accessed radiology images stored on its PACS server between April 2019 and January 202. The investigation found NERAD failed to conduct an accurate and thorough risk analysis to determine the potential risks and vulnerabilities to the ePHI in NERAD’s information systems.

Resolution agreement. Under the resolution agreement, NERAD will implement a corrective action plan to be monitored by OCR for two years. Under the corrective action plan, NERAD will take steps to improve its compliance with the HIPAA Security Rule and protect the security of ePHI, including: (1) conducting an accurate and thorough risk analysis to determine potential risks and vulnerabilities to the confidentiality, integrity, and availability of its ePHI; (2) developing and implementing a risk management plan to address and mitigate security risks and vulnerabilities identified in its risk analysis; (3) developing and implementing a written process to regularly review records of information system activity; (4) developing, maintaining, and revising, as necessary, its written policies and procedures to comply with the HIPAA rules; and (5) augmenting its existing HIPAA and security training program to all its workforce members who have access to PHI.

CIAsSettlementAgreements: SettlementAgreementsNews ConfidentialityNews CyberPrivacyFeed EHRNews HIPAANews DataPrivacy DataSecurity DataBreach LitigationEnforcement