Two Years on Probation, $140,000 Lighter: The Price of Healthcare’s Insider Threat

A former healthcare executive in Kentucky has been sentenced to probation and ordered to pay restitution after admitting to disclosing patients’ protected health information (PHI) in violation of HIPAA. This case highlights the ongoing threat of insider data breaches in the healthcare industry and the importance of strong data security measures.

The Case:

Mark Kevin Robison, a former vice president at Commonwealth Health Corporation (now Med Center Health), pleaded guilty to knowingly disclosing PHI of patients under false pretenses to an unauthorized third party between 2014 and 2015. While details of the unauthorized disclosure remain unclear, the incident underscores the potential harm caused by insider data breaches within healthcare organizations.

Avoiding Jail, Facing Consequences:

Despite facing a potential five-year prison sentence and a $100,000 fine, Robison’s plea deal secured him two years of probation and a $140,000 restitution to the hospital. Half of the restitution has already been paid, and Robison is expected to cover the remaining amount by the end of January.

Lessons Learned:

The Robison case serves as a stark reminder of the importance of data security in healthcare. Healthcare organizations must:

• Emphasize HIPAA compliance: Conduct regular training for employees on HIPAA regulations and best practices for handling PHI.
• Implement strong access controls: Limit access to patient data based on the principle of least privilege, ensuring only authorized personnel can access specific information.
• Monitor and audit access: Regularly monitor and audit system activity to identify suspicious or unauthorized access attempts.
• Report and investigate breaches: Have a clear protocol for reporting and investigating potential HIPAA violations.

Insider Threats Remain a Challenge:

While HIPAA violations by external hackers often grab headlines, insider threats like the Robison case pose a significant and often underestimated risk. Healthcare organizations must prioritize data security measures that take into account both external and internal threats.

Looking Ahead:

This case should serve as a wake-up call for healthcare organizations to redouble their efforts to protect patient data. By prioritizing data security and creating a culture of compliance, healthcare providers can help ensure that patients’ personal information remains safe and secure.

To learn more on how to ensure your practice is compliant, email info@abyde.com and schedule an educational consultation.