By Journal Staff

Idaho State University has agreed to pay $400,000 to the U.S. Department of Health and Human Services for violations of the Health Insurance Portability and Accountability Act of 1996 Security Rule, according to a news release issued by the U.S. Office for Civil Rights.
This settlement involves the potential breach of unsecured electronic protected health information of 17,500 people who were patients at an ISU clinic during the fall and spring semesters of 2010-11.
However, no individual patient information was ever compromised, according to ISU officials.
The Office for Civil Rights opened its investigation after ISU notified HHS that health information of about 17,500 people was accessible at its Pocatello Family Medicine Clinic because an ISU server firewall was disabled.
“After working closely with OCR (Office for Civil Rights) for over a year, we were prepared to accept their findings and learn from this experience,” said Gregory Ehardt, ISU HIPAA/Assistant Compliance Officer.
The Civil Rights Office investigators found that ISU did not apply proper security measures and policies to address risks to health records and did not have in place procedures for routine review of information system activity which could have detected the breach in the firewall much sooner. Overall, ISU failed to ensure the uniform implementation of required Security Rule protections at each of its covered clinics.
“The firewall was disabled for maintenance purposes and unfortunately was not restored properly,” Ehardt said. “It was disabled from approximately August 2010 to May 2011. We did not have the proper security measures at Pocatello Family Medicine at the time.”
The firewall protected a university server storing individually identifiable information.
“As soon as we discovered that individually identifiable data was on this server, we chose to report,” Ehardt said. “Upon further due diligence, however, we determined that no patient records were accessed and the data was not compromised.”
In addition to notifying all individuals with information on this particular server, the university provided free credit monitoring for potentially affected patients of the clinic.