The decision stems from an investigation of a complaint that a Lincare employee had moved, leaving behind documents containing federally protected healthcare records of 278 patients.
According to HHS' Office for Civil Rights, “Lincare had inadequate policies and procedures in place to safeguard patient information that was taken off-site, although employees, who provide healthcare services in patients' homes, regularly removed material from the business premises.”
The Office for Civil Rights also said Lincare had an "unwritten policy" requiring certain employees to keep patient records in their own vehicles for extended periods of time and took only minimal corrective actions even after learning of the agency's complaint and investigation.
Lincare Holdings, based in Clearwater, Fla., is a subsidiary of the German company Linde Group, a manufacturer of, among other things, various gases for healthcare and industrial uses. Lincare and Linde did not immediately respond to requests for comment.
Since 2008, there have been 30 Office for Civil Rights investigations of privacy and security rule violations that have led to monetary payments, according to the agency's website. Most have ended in negotiated settlements.
In 2011, however, the office went after Cignet Health of Prince George's County, Md., for refusing to supply several of its patients with copies of their records and sought a $4.3 million civil monetary penalty. That case eventually went to court. Cignet lost and was ordered to pay nearly $4.8 million.
Joseph Conn reports on information technology, privacy and data security. He has been a reporter and editor for 35 years for various news publications and taught journalism at Valparaiso (Ind.) University, where he earned his bachelor's degree in English. He also worked as a Peace Corps volunteer in Sierra Leone. Conn joined Modern Physician in 2000, serving as reporter, editor and online editor. He joined Modern Healthcare in 2005.Follow on Twitter