We encrypt laptops and cell phones. We get business associate agreements to make sure our vendors protect our patient’s confidentiality. We have data breach policies in place. That’s already a load.

There’s always something else to do.

On August 14, 2013, Dept. Health and Human Services settled with Affinity Health Plan, a non-profit managed care entity to the tune of $1.2 million dollars. Affinity leased copiers from a third party – and presumably returned these copies to the leasing entity when the contract expired.

Affinity indicated that it was informed by a representative of CBS Evening News that, as part of an investigatory report, CBS had purchased a photocopier previously leased by Affinity.  CBS informed Affinity that the copier that Affinity had used contained confidential medical information on the hard drive.

Affinity estimated that up to 344,579 individuals may have been affected by this breach. [Office of Civil Rights’] investigation indicated that Affinity impermissibly disclosed the protected health information of these affected individuals when it returned multiple photocopiers to leasing agents without erasing the data contained on the copier hard drives.  In addition, the investigation revealed that Affinity failed to incorporate the electronic protected health information (ePHI) stored on photocopier hard drives in its analysis of risks and vulnerabilities as required by the Security Rule, and failed to implement policies and procedures when returning the photocopiers to its leasing agents.

The take-home message: Make sure hard-drives on devices (such as copiers, faxes, scanners) are wiped when returned or retired. Or make sure the leasing entities have business associate agreements in place and that they agree to perform this function when the devices ar