ALJ sides with feds, Lincare must pay $240K penalty

Thursday, February 4, 2016

CLEARWATER, Fla. – Lincare will pay nearly $239,800 in civil monetary penalties for violating the Health Insurance Portability and Accountability Act, a U.S. Department of Health and Human Services Administrative Law Judge ruled Feb. 3. This is only the second time in its history that the Office for Civil Rights has sought civil monetary penalties for HIPAA violations. Each time, the penalties have been upheld by the ALJ. OCR’s investigation of Lincare began after an individual complained that a Lincare employee left behind documents containing the protected health information of 278 patients after moving residences. OCR found that this employee removed protected health information form the company’s office, left the information exposed in places where an unauthorized person had access to it and then abandoned the information altogether. OCR found that Lincare had inadequate policies and procedures in place to safeguard patient information that was taken offsite. “Although aware of the complaint and OCR’s investigation, Lincare subsequently took only minimal action to correct its policies and strengthen safeguards to ensure compliance with the HIPAA rules,” HHS stated in a release. Lincare claimed it had not violated HIPAA because the patient information was “stolen” by the individual who discovered it on the premises previously shared with the Lincare employee. The ALJ rejected this argument, agreeing with OCR that under HIPAA, Lincare was obligated to take reasonable steps to protect its patient information from theft.