Most entities presume that if they are not health care providers they do not need to worry about HIPAA. That is not always the case, as the Department of Health and Human Services reminded us this summer. The department settled with Spencer Gifts following the entity’s 2021 data breach. That settlement came on the heels of class complaints against the retailer, which had suffered a ransomware attack that impacted employee personal information.
Among the information involved were documents that related to employees’ enrollment in the employee health plan. According to HHS, the information included members’ Social Security Numbers and contact details. Under HIPAA, as the OCR noted in its settlement, employer health plans are covered entities subject to the law’s privacy and security rules. As such, they must conduct risk assessments and have reasonable HIPAA policies and procedures. Two things the OCR found that the company had not done.
To resolve the matter, the company agreed not only to pay $450,000, but to a corrective action plan monitored by OCR. As part of the plan, the company will take several corrective steps. These steps serve as a reminder for anyone who operates group health plans, which for HIPAA includes employee welfare benefit plans regulated by ERISA.
The company will do the following as part of the plan:
- Conduct a security risk analysis to assess potential risks to electronic protected health information: As part of the security risk analysis, the company agreed to identify all locations where it holds protected health information and assess the risks to the security of that information in those locations. HHS will oversee both the risk analysis methodology and receive results from the company.
- Revise policies and procedures to address HIPAA: As part of the policies and procedures, the company agreed to include a documented process to make sure that it is addressing HIPAA. The company also agreed to include a process for regularly reviewing audit logs and access reports and procedures for protecting against malicious software. The plan will also have access controls and processes for addressing emergencies, including maintenance of adequate backups.
- Conduct HIPAA training with its workforce: The company agreed to provide its HIPAA training to HHS for review, and to make any requested changes. It also agreed to train its entire workforce, and to continue to do so annually. New hires, it agreed, would receive HIPAA training within their first 30 days. No employee, it agreed, would be able to access protected health information if they had not completed their training.
Putting It Into Practice: As you develop your compliance priorities for the rest of 2026 and into 2027, this settlement is a reminder to put HIPAA on your roadmap. Review the locations where you may have protected health information and the protection measures in place for it and those systems. Now is also a good time to review your relevant policies and procedures for HIPAA compliance.