SlideShare a Scribd company logo
1 of 15
Download to read offline
RESOLUTION AGREEMENT
I. Recitals
1. Parties. The Parties to this Resolution Agreement (“Agreement”) are the United
States Department of Health and Human Services, Office for Civil Rights (“HHS”) and
Shasta Regional Medical Center (“SRMC”) and all other facilities listed in Appendix B
hereinafter referred to collectively in this Agreement as “Covered Entities”. Appendix B,
listing Shasta Regional Medical Center and all other facilities currently under the same
ownership or operational control that meet the definition of a “health care provider” and
“covered entity” as defined in 45 C.F.R. Section 160.103, is incorporated in to this
Resolution Agreement by reference.
2.
A. Authority of HHS
Factual Background and Covered Conduct
HHS enforces the Federal Standards for Privacy of Individually Identifiable Health
Information (45 C.F.R. Part 160 and Subparts A and E of Part 164, the “Privacy Rule”) and
the Federal Security Standards for the Protection of Electronic Protected Health Information
(45 C.F.R. Part 160 and Subparts A and C of Part 164, the “Security Rule”). HHS has the
authority to conduct investigations of complaints alleging violations of the Privacy and
Security Rules by covered entities, and a covered entity must cooperate with HHS’s
investigation. 45 C.F.R. §§160.306(c) and 160.310(b).
B. Covered Entities
SRMC and other facilities currently under the same ownership or operational control
listed in Appendix B are health care providers as defined at 45 C.F.R. §160.103 that transmit
health information in electronic form in connection with a transaction covered by 45 C.F.R.
Part 162 and therefore are covered entities required to comply with the Privacy Rule.
C. Covered Conduct
On January 6, 2012, HHS notified SRMC of its initiation of a compliance review of
its facility to determine whether there was a failure to comply with the requirements of the
Privacy Rule. HHS’s compliance review was prompted by an article in the Los Angeles
Times published on January 4, 2012. The article indicated that two of SRMC’s senior leaders
met with the media to discuss the medical services provided to a patient (the Affected Party)
without a valid written authorization.
Page 2
HHS’s investigation indicated that the following conduct occurred (“Covered Conduct”):
a) From December 13 – 20, 2011, SRMC failed to safeguard the Affected Party’s PHI
from any impermissible intentional or unintentional disclosure on multiple occasions
as described below. This failure was evidenced by the following facts:
i) On December 13, 2011, SRMC sent a letter, through its parent company, to
California Watch, responding to a story concerning Medicare fraud. The letter
described the Affected Party’s medical treatment and provided specifics about her
lab results. SRMC did not have a written authorization from the Affected Party to
disclose this information to this news outlet.
ii) On December 16, 2011, two of SRMC’s senior leaders met with The Record
Searchlight’s editor to discuss the Affected Party’s medical record in detail.
SRMC did not have a written authorization from the Affected Party to disclose
this information to this newspaper.
iii) On December 20, 2011, SRMC sent a letter to The Los Angeles Times, which
contained detailed information about the treatment the Affected Party received.
SRMC did not have a written authorization from the Affected Party to disclose
this information to this newspaper.
b) SRMC impermissibly used the affected party’s PHI. This failure was evidenced by
the following facts:
i) On December 20, 2011, SRMC sent an email to its entire workforce and medical
staff, approximately 785-900 individuals, describing, in detail, the Affected
Party’s medical condition, diagnosis and treatment. SRMC did not have a written
authorization from the Affected Party to share this information with SRMC’s
entire workforce and medical staff.
c) SRMC has failed to sanction its workforce members pursuant to its internal sanctions
policy which requires that it sanction employees for “violations of HIPAA”.
3. No Admission. This Agreement is not an admission of liability by Covered
Entities.
4. No Concession. This Agreement is not a concession by HHS that Covered
Entities are not in violation of the Privacy Rule and not liable for civil money penalties.
5. Intention of Parties to Effect Resolution. This Agreement is intended to resolve the
Compliance Review 12-137198 regarding possible violations of the Privacy Rule promulgated
by HHS pursuant to the administrative simplification provisions of the Health Insurance
Portability and Accountability Act of 1996 (HIPAA) Pub.L. 104-191, 110 Stat. 1936. In
consideration of the Parties’ interest in avoiding the uncertainty, burden, and expense of further
investigation and formal proceedings, the Parties agree to resolve this matter according to the
Terms and Conditions below.
Page 3
II. Terms and Conditions
6. Compliance Representative. Each facility listed in Appendix B other than SRMC,
shall designate an individual to serve as its Compliance Representative under this Agreement and
under the Corrective Action Plan (CAP). These facilities agree to appoint a single individual to
serve as the Compliance Representative for each of them. The Covered Entities shall provide
OCR on the Effective Date with the name of the Compliance Representative. The Compliance
Representative, in regard to the facilities listed in Appendix B other than SRMC, shall be the
Contact Person and signatory under this Agreement and CAP, and shall be responsible for
ensuring compliance with the Agreement and CAP.
7. Payment. Covered Entities agree to pay HHS the amount of Two Hundred and
Seventy Five Thousand Dollars ($275,000.00) as the Resolution Amount. Covered Entities
agree to pay the Resolution Amount by electronic funds transfer pursuant to written instructions
to be provided by HHS. Covered Entities agree to make this payment on or before the date it
signs this Agreement.
8. Corrective Action Plan. Covered Entities have entered into and agree to comply with
the Corrective Action Plan (CAP), attached as Appendix A, which is incorporated into this
Agreement by reference. If SRMC or any facility listed in Appendix B breaches the CAP, and
fails to cure the breach as set forth in the CAP, then Covered Entities will be in breach of this
Agreement and HHS will not be subject to the Release set forth in paragraph 9 of this
Agreement.
9. Release by HHS. In consideration of and conditioned upon Covered Entities’
performance of all of its obligations under this Agreement, HHS releases Covered Entities from
any actions it may have under the Privacy Rule for the covered conduct indentified in paragraph
2. HHS does not release Covered Entities from, nor waive any rights, obligations, or causes of
action other than those specifically referred to in this paragraph. This release does not extend to
actions that may be brought under Section 1177 of the Social Security Act, 42 U.S.C. § 1320d-6.
10. . Covered Entities shall not contest the validity of its
obligation to pay, nor the amount of, the Resolution Amount or any other obligations agreed to
under this Agreement. Covered Entities waive all procedural rights granted under Section
1128A of the Social Security Act (42 U.S.C. § 1320a- 7a) and 45 C.F.R. Part 160 Subpart E, and
HHS claims collection regulations at 45 C.F.R. Part 30, including, but not limited to, notice,
hearing, and appeal with respect to the Resolution Amount.
11. Binding on Successors. This Agreement is binding on Covered Entities and their
successors, heirs, and transferees.
//
Agreement by Released Party
Page 4
12. Costs. Each Party to this Agreement shall bear its own legal and other costs incurred
in connection with this matter, including the preparation and performance of this Agreement.
13. No Additional Releases. This Agreement is intended to be for the benefit of the
Parties only and, by this instrument, the Parties do not release any claims against any other
person or entity.
14. Effect of Agreement. This Agreement constitutes the complete agreement between
the Parties. All material representations, understandings, and promises of the Parties are
contained in this Agreement. Any modifications to this Agreement must be set forth in writing
and signed by all Parties.
15. Execution of Agreement and Effective Date. This Agreement shall become effective
(i.e., final and binding) upon the date of signing this Agreement and the CAP by the last
signatory (Effective Date).
16. Tolling of Statute of Limitations. Pursuant to 42 U.S.C. § 1320a-7a(c) (1), a civil
money penalty (CMP) must be imposed within six (6) years from the date of the occurrence of
the violation. To ensure that this six-year period does not expire during the term of this
Agreement, Covered Entities agree that the time between the Effective Date of this Agreement
(as set forth in paragraph 14) and the date that same may be terminated by reason of the Covered
Entities’ breach, plus one-year thereafter, will not be included in calculating the six (6) year
statute of limitations applicable to the violations which are the subject of this Agreement.
Covered Entities waive and will not plead, any statute of limitations, laches, or similar defenses
to any administrative action relating to the Covered Conduct identified in paragraph 2 of this
Agreement that may be filed by HHS within the time period set forth above, except to the extent
that such defenses would have been available had an administrative action been filed on the
Effective Date of this Resolution Agreement.
17. Disclosure. There are no restrictions on the publication of the Agreement. This
Agreement and information related to this Agreement may be made public by either party. In
addition, HHS may be required to disclose this Agreement and related material to any person
upon request consistent with the applicable provisions of the Freedom of Information Act, 5
U.S.C. § 552, and its implementing regulations, 45 C.F.R. Part 5.
18. Execution in Counterparts. This Agreement may be executed in counterparts, each of
which constitutes an original, and all of which shall constitute one and the same agreement.
//
//
Page 5
19. Authorizations. The individual(s) signing this Agreement on behalf of Covered
Entities represent and warrant that they are authorized by Covered Entities to execute this
Agreement. The individual(s) signing this Agreement on behalf of HHS represent and warrant
that they are signing this Agreement in their official capacities and that they are authorized to
execute this Agreement
For Covered Entities
/s/ 05/31/2013
____________________________ ____________
Randall Hempling Date
Chief Executive Officer
Shasta Regional Medical Center
/s/ 06/03/2013
_____________________________ ______________
Chris Doan Date
Chief Compliance Officer
Prime Healthcare Management, Inc.
For U.S. Department of Health and Human Services
/s/ 06/06/2013
____________________________ _____________
Michael Leoz Date
Regional Manager, Region IX
U.S. Department of Health and Human Service
Office for Civil Rights
Page 6
Appendix A
CORRECTIVE ACTION PLAN
BETWEEN THE
DEPARTMENT OF HEALTH AND HUMAN SERVICES
AND
SHASTA REGIONAL MEDICAL CENTER AND FACILITIES LISTED IN APPENDIX B
I. Preamble
The parties to this Resolution Agreement, Shasta Regional Medical Center (“SRMC”),
and all other facilities listed in Appendix B, are hereinafter referred to collectively as “Covered
Entities”. Covered Entities hereby enter into this Corrective Action Plan ("CAP") with the
United States Department of Health and Human Services, Office for Civil Rights ("HHS").
Contemporaneously with this CAP, Covered Entities are entering into a Resolution Agreement
("Agreement") with HHS, and this CAP is incorporated by reference into the Agreement as
Appendix A. Appendix B, listing Shasta Regional Medical Center and all other facilities.
currently under the same ownership or operational control that meet the definition of a “health
care provider” and “covered entity” as defined in 45 C.F.R. Section 160.103, is incorporated in
to this Resolution Agreement by reference. Covered Entities enter into this CAP as
consideration for the release set forth in paragraph 9 of the Agreement.
II. Contact Persons and Submissions
A.
Covered Entities have identified the following individuals as their authorized
representative and contact person regarding the implementation of this CAP and for receipt and
submission of notifications and reports:
Contact Persons
For SRMC:
Randall Hempling
Chief Executive Officer
Shasta Regional Medical Center
1100 Butte Street
Redding, CA 96049
Telephone: (530) 244-5400
Facsimile: (530)-244-5119
Page 7
Compliance Representative for other Covered Entities listed in Appendix B:
Chris Doan
Chief Compliance Officer
Prime Healthcare Management, Inc.
3300 Guasti Road
Ontario, CA 91761
Telephone: (909) 235-4400
Facsimile: (909) 235-4419
HHS has identified the following individual as its authorized representative and contact
person to whom the Covered Entities are to report information regarding the implementation of
this CAP:
Michael Leoz, Regional Manager
Office for Civil Rights, Region IX
U.S. Department of Health and Human Services
90 7th
Street, Suite 4-100
San Francisco, CA 94103
Telephone: (415) 437-8310
Facsimile: (415) 437-8329
Covered Entities and HHS agree to promptly notify each other of any changes in the
contact persons or the other information provided above.
B. Proof of Submissions. Unless otherwise specified, all notifications and reports
required by this CAP may be made by any means, including certified mail, overnight
mail, or hand delivery, provided that there is proof that such notification was received.
For purposes of this requirement, internal facsimile confirmation sheets do not constitute
proof of receipt.
III. Term of CAP
The period of compliance obligations assumed by Covered Entities under this CAP shall
be one (1) year from the effective date of this CAP (“Effective Date”), except that, after this
period, Covered Entities shall be obligated to: comply with the document retention requirement
set forth in section VIII. The Effective Date of this CAP shall be calculated in accordance with
paragraph 15 of the Agreement.
IV. Time
In computing any period of time prescribed or allowed by this CAP, the day of the act,
event, or default from which the designated period of time begins to run shall not be included.
The last day of the period so computed shall be included, unless it is a Saturday, a Sunday, or a
Page 8
legal holiday, in which event the period runs until the end of the next day that is not one of the
aforementioned days.
V. Shasta Regional Medical Center Corrective Action Obligations
Shasta Regional Medical Center, agrees to the following:
A. Policies and Procedures
1. SRMC shall develop, maintain and revise, as necessary, its written
policies and procedures (“Policies and Procedures”) applicable to all of its
facilities and subsidiaries to comply with the Federal standards that govern the
privacy of individually identifiable health information (45 C.F.R. Part 160 and
Subparts A and E of Part 164, the “Privacy Rule”). SRMC’s Policies and
Procedures shall include, but not be limited to, the minimum content set forth in
section V.C. below.
2. SRMC shall provide such Policies and Procedures consistent with
paragraph 1 above, to HHS within ninety (90) calendar days of the Effective Date
for review and approval. Upon receiving any recommended changes to such
Policies and Procedures from HHS, SRMC shall have sixty (60) calendar days to
revise such Policies and Procedures accordingly and provide the revised Policies
and Procedures to HHS for review and approval.
3. SRMC shall implement the Policies and Procedures within ninety (90)
calendar days of HHS’s approval.
B. Distribution and Updating of Policies and Procedures
1. SRMC shall distribute such Policies and Procedures to all workforce
members at all of its facilities and subsidiaries who use and disclose PHI within
sixty (60) calendar days of HHS’s approval of such Policies and Procedures.
SRMC shall distribute the Policies and Procedures to any new workforce
members who use and disclose PHI within thirty (30) days of their beginning of
service.
2. SRMC shall require, at the time of distribution of such Policies and
Procedures, a signed written or electronic initial compliance certification from all
workforce members who use and disclose PHI stating that the workforce
members have read, understands, and shall abide by such Policies and Procedures.
3. SRMC shall assess, update, and revise, as necessary, the Policies and
Procedures, at least annually (and more frequently if appropriate). If changes,
revisions or updates are required during the term of the Agreement, SRMC shall
provide such revised Policies and Procedures to HHS for review and approval.
Within 30 days of the effective date of any approved substantive revisions, SRMC
shall distribute such revised Policies and Procedures to all workforce members
and shall require new compliance certifications.
Page 9
4. SRMC shall not involve any workforce member who uses and discloses
PHI if that workforce member has not signed or provided the written or electronic
certification as required by paragraphs 2 & 3 of this section.
C. Minimum Content of the Policies and Procedures
The Policies and Procedures shall include, but not be limited to:
Safeguards Implementation Specifications (45 C.F.R. §164.530(c)(2)(i)).
1. Instructions and Procedures that address appropriate administrative, technical, and
physical safeguards to protect PHI from any intentional or unintentional use or
disclosure (a) for media inquiries and (b) that define PHI as it relates to
individually identifiable health information (IIHI).
2. Protocols for training all members of SRMC’s workforce who use and disclose
PHI to ensure that they know how to comply with the Policies and Procedures
provided for in subparagraph (1) above.
Uses and Disclosures (45 C.F.R. §164.502(a))
1. Instructions and Procedures that address permissible and impermissible uses and
disclosures of PHI (a) for media inquiries, (b) to workforce members who are not
involved in the individual’s medical care and (c) that define PHI as it relates to
individually identifiable health information (IIHI).
2. Application of appropriate sanctions against members of SRMC’s workforce who
fail to comply with Policies and Procedures provided for in subparagraph (1)
above.
3. Protocols for training all members of SRMC’s workforce who use and disclose
PHI to ensure that they know how to comply with the Policies and Procedures
provided for in subparagraph (1) above.
Administrative Requirements Sanctions (45 C.F.R. §164.530(e)).
1. Instructions and Procedures that address (a) What is individually identifiable
health information (IIHI) and the protected health information (PHI), including
what is required for PHI to be unidentified; (b) Communicating with, and
responding to, the media, including in regard to patient-related inquires, and (c)
Sharing of patient PHI within SRMC, including sharing of patient PHI with
workforce members not involved in the provision of or payment for care.
2. Protocols for training all SRMC’s workforce members who use and disclose PHI
to ensure that they know how to comply with the Policies and Procedures
provided for in subparagraph (1) above.
Page 10
3. Application of appropriate sanctions against SRMC’s workforce members who
fail to comply with Policies and Procedures provided for in subparagraph (1)
above.
D. Reportable Events
1. If SRMC determines that a workforce member has violated these Policies and
Procedures required by section V.A.1., SRMC shall notify HHS in writing within
thirty (30) days. Such violations shall be known as “Reportable Events.” The
report to HHS shall include the following information:
a. A complete description of the event, including the relevant facts, the
persons involved, and the provision(s) of the Policies and Procedures
implicated; and
b. A description of SRMC’s actions taken to mitigate any harm and any
further steps SRMC plans to take to address the matter and prevent it from
recurring.
E. Training
1. All workforce members who use or disclose PHI shall receive specific
training related to the Policies and Procedures. Within ninety (90) days of the
implementation of the Policies and Procedures. SRMC shall provide such training
to each new member of the workforce within thirty (30) calendar days of the
workforce member’s beginning as a workforce member.
2. Each workforce member who is required to attend training shall certify, in
electronic or written form, that he or she received the training. The training
certification shall specify the date training was received. All course materials
shall be retained in compliance with section VII.
3. SRMC shall review the training at least annually, and, where appropriate,
update the training to reflect any changes in Federal law or HHS guidance, any
issues discovered during audits or reviews, any other relevant developments.
4. SRMC shall not involve any member of its workforce in the use or
disclosure of PHI if that workforce member has not signed or provided the written
or electronic training certification as required by paragraph 2 this section.
VI. Shasta Regional Medical Center Implementation Report and Annual Report
A. Within ninety (90) days after the receipt of HHS’s approval of the Policies and
Procedures required by section V.A.1., SRMC shall submit a written report to HHS
summarizing the status of its implementation of the requirements of this CAP. This
report, known as the “Implementation Report,” shall include:
Page 11
1. An attestation signed by SRMC’s authorized representative attesting that
the Policies and Procedures have been implemented, have been distributed to all
appropriate workforce members and that SRMC has obtained all of the
compliance certifications required by section V.B.2. and V.B.3;
2. A copy of all training materials used for the training required by this CAP,
a description of the training, including a summary of the topics covered, the
length of the session(s) and a schedule of when the training session(s) were held;
3. An attestation signed by SRMC’s authorized representative attesting that
all members of the workforce who use or disclose PHI have completed the initial
training required by this CAP and have executed the training certifications
required by section V.E.2.; and
4. A summary of Reportable Events (defined in section V.D) that have
occurred since the Effective Date of this CAP and the status of any corrective and
preventative action(s) relating to all such Reportable Events; and
5. An attestation signed by SRMC’s authorized representative stating that he
or she has reviewed the Implementation Report, has made a reasonable inquiry
regarding its content and believes that, upon such inquiry, the information is
accurate and truthful.
B. Annual Report. SRMC also shall submit to HHS an Annual Report with respect to
the status of and findings regarding SRMC’s compliance with this CAP. SRMC shall
submit the Annual Report to HHS no later than nine-months after the Effective Date. The
Annual Report shall include:
1. A schedule, topic outline, and copies of the training materials for the
training programs attended in accordance with this CAP;
2. An attestation signed by an owner or officer of SRMC attesting that it is
obtaining and maintaining written or electronic training certifications from all
persons that require training that they received training pursuant to the
requirements set forth in this CAP;
3. A summary of Reportable Events (defined in section V.D.) identified and
the status of any corrective and preventative action relating to all such Reportable
Events;
4. An attestation signed by an owner or officer of SRMC attesting that he or
she has reviewed the Annual Report, has made a reasonable inquiry regarding its
content and believes that, upon such inquiry, the information is accurate and
truthful.
//
Page 12
VII. Requirement for all facilities listed in Appendix B other than SRMC
Affidavit. The CEO and Privacy Officer of each facility listed in Appendix B,
excluding Shasta Regional Medical Center, shall submit an affidavit to OCR,
through the Compliance Representative, stating that they understand that (a) an
individual’s protected health information (“PHI”) is protected by Privacy Rule
even if such information is already in the public domain or even though it has
been disclosed by the individual; and (b) disclosures of PHI in response to media
inquiries are only permissible pursuant to a signed HIPAA authorization. Each
facility will ensure that all members of their respective workforce are informed of
this policy. The Affidavits shall be submitted to OCR by the Compliance
Representative within sixty (60) calendar days of the Effective Date of this
Agreement.
VIII. Document Retention
Covered Entities shall maintain for inspection and copying all documents and records
relating to compliance with this CAP for six (6) years.
IX. Breach Provisions
Covered Entities are expected to fully and timely comply with all provisions contained in
this CAP.
A. Timely Written Requests for Extensions. Covered Entities may, in advance of any
due date set forth in this CAP, submit a timely written request for an extension of time to
perform any act required by this CAP. A “timely written request” is defined as a request
in writing received by HHS at least five (5) business days prior to the date such an act is
required to be performed or any notification or report is due to be filed.
B. Notice of Breach and Intent to Impose CMP. The parties agree that a breach of
the CAP by SRMC or any of the facilities listed in Appendix B constitutes a breach of the
Agreement. Upon a determination by HHS that SRMC or any of the facilities listed in
Appendix B has breached this CAP, HHS may notify Covered Entities of: (a) The
breach; and (b) HHS’ intent to impose a civil monetary penalty (CMP) pursuant to 45
C.F.R. Part 160 for the Covered Conduct set forth in paragraph 2 of the Agreement and
any other conduct that constitutes a violation of the HIPAA Privacy Rule (this
notification is hereinafter referred to as the “Notice of Breach and Intent to Impose
CMP”).
C. Covered Entities’ Response. Covered Entities shall have thirty (30) days from the
date of receipt of the Notice of Breach and Intent to Impose CMP to demonstrate to
HHS’s satisfaction that
1. Covered Entities are in compliance with the obligations of the CAP cited
by HHS as the basis for the breach; or
Page 13
2. The alleged breach has been cured; or
3. The alleged breach cannot be cured within the thirty (30) day period, but
that (i) Covered Entities have begun to take action to cure the breach; (ii) Covered
Entities are pursuing such action with due diligence; and (iii) Covered Entities
have provided to HHS a reasonable timetable for curing the breach.
D. Imposition of CMP. If, at the conclusion of thirty (30) day period, Covered
Entities fail to meet the requirements of section IX C to HHS’s satisfaction, HHS may
proceed to impose a CMP pursuant to 45 C.F.R. Part 160 for the Covered Conduct set
forth in paragraph 2 of the Agreement and any other conduct that constitutes a violation
of the HIPAA Privacy Rule. HHS shall notify Covered Entities in writing of its
determination to proceed with the imposition of a CMP.
For Covered Entities
/s/ 05/31/2013
________________________________ _____________
Randall Hempling Date
Shasta Regional Medical Center
/s/ 06/03/2013
________________________________ ______________
Chris Doan Date
Prime Healthcare Management, Inc.
For U.S. Department of Health and Human Services
/s/ 06/06/2013
____________________________ _____________
Michael Leoz Date
Regional Manager, Region IX
DHHS, Office for Civil Rights
Page 14
APPENDIX B
LIST OF PRIME HEALTHCARE SERVICES FACILITIES
CALIFORNIA FACILITIES:
Alvarado Hospital Medical Center
6655 Alvarado Road
San Diego, CA 92120
Centinela Hospital Medical Center
555 E. Hardy Street
Inglewood, CA 90301
Chino Valley Medical Center
5451 Walnut Avenue
Chino, CA 91710
Desert Valley Hospital
16850 Bear Valley Road
Victorville, CA 92395
Garden Grove Hospital Medical Center
12601 Garden Grove Blvd.
Garden Grove, CA 92843
La Palma Intercommunity Hospital
901 Walker Street
La Palma, CA 90623
Paradise Valley Hospital
2400 East Fourth Street
National City, CA 91950
San Dimas Community Hospital
1350 W. Covina Boulevard
San Dimas, CA 91773
Shasta Regional Medical Center
1100 Butte Street
Redding, CA 96001
West Anaheim Medical Center
3033 West Orange Avenue
Anaheim, CA 92804
Page 15
NEVADA FACILTY:
Saint Mary's Regional Medical Center
235 West 6th Street
Reno, NV 89503
PENNSYLVANIA FACILITIES:
Lower Bucks Hospital
501 Bath Road
Bristol, PA 19007
Roxborough Memorial Hospital
5800 Ridge Avenue
Philadelphia, PA 19128
TEXAS FACILITIES:
Dallas Medical Center
7 Medical Parkway
Dallas, TX 75234
Harlingen Medical Center
5501 South Expressway 77
Harlingen, TX 78550
Pampa Regional Medical Center
One Medical Plaza
Pampa, TX 79065

More Related Content

What's hot

Parkview HIPAA Settlement - Resolution Agreement
Parkview HIPAA Settlement - Resolution AgreementParkview HIPAA Settlement - Resolution Agreement
Parkview HIPAA Settlement - Resolution Agreementdata brackets
 
NYP RA and CAP april 2016
NYP RA and CAP april 2016 NYP RA and CAP april 2016
NYP RA and CAP april 2016 data brackets
 
Cancer Care Group HIPAA Settlement Agreement
Cancer Care Group HIPAA Settlement AgreementCancer Care Group HIPAA Settlement Agreement
Cancer Care Group HIPAA Settlement Agreementdata brackets
 
HONI HIPAA Breach Resolution Agreement
HONI HIPAA Breach Resolution AgreementHONI HIPAA Breach Resolution Agreement
HONI HIPAA Breach Resolution Agreementdata brackets
 
HIPAA Settlement New York Presbyterian and Columbia Universtiy
HIPAA Settlement New York Presbyterian and Columbia UniverstiyHIPAA Settlement New York Presbyterian and Columbia Universtiy
HIPAA Settlement New York Presbyterian and Columbia Universtiydata brackets
 
"Will Congress Fix The Stark Law Disclosure Dilemma?"
"Will Congress Fix The Stark Law Disclosure Dilemma?""Will Congress Fix The Stark Law Disclosure Dilemma?"
"Will Congress Fix The Stark Law Disclosure Dilemma?"amnonwitten
 
an_update_on_the_application_of_unfair_claims_settlement_practices
an_update_on_the_application_of_unfair_claims_settlement_practicesan_update_on_the_application_of_unfair_claims_settlement_practices
an_update_on_the_application_of_unfair_claims_settlement_practicesAntonio Trotta
 
Oakland Housing Authority Legal Services Contract For General Counsel This
Oakland Housing Authority Legal Services Contract For General Counsel ThisOakland Housing Authority Legal Services Contract For General Counsel This
Oakland Housing Authority Legal Services Contract For General Counsel Thislegal3
 
Broad Application of Medicare’s Mandatory Insurer Reporting Requirements to N...
Broad Application of Medicare’s Mandatory Insurer Reporting Requirements to N...Broad Application of Medicare’s Mandatory Insurer Reporting Requirements to N...
Broad Application of Medicare’s Mandatory Insurer Reporting Requirements to N...NationalUnderwriter
 
Item # 10 Catto & Catto to HUB Insurance Broker Assignment
Item # 10  Catto & Catto to HUB Insurance Broker AssignmentItem # 10  Catto & Catto to HUB Insurance Broker Assignment
Item # 10 Catto & Catto to HUB Insurance Broker Assignmentahcitycouncil
 
Kolbe v. Medical College Nov. 2009
Kolbe v. Medical College Nov. 2009Kolbe v. Medical College Nov. 2009
Kolbe v. Medical College Nov. 2009ThompsonPub
 
Cancellation of removal in immigration court
Cancellation of removal in immigration courtCancellation of removal in immigration court
Cancellation of removal in immigration courtUmesh Heendeniya
 
Unfair claims-settlement-practices-act
Unfair claims-settlement-practices-actUnfair claims-settlement-practices-act
Unfair claims-settlement-practices-actLira Venture Capital
 

What's hot (17)

Parkview HIPAA Settlement - Resolution Agreement
Parkview HIPAA Settlement - Resolution AgreementParkview HIPAA Settlement - Resolution Agreement
Parkview HIPAA Settlement - Resolution Agreement
 
Concentra agreement
Concentra agreementConcentra agreement
Concentra agreement
 
Affinity agreement
Affinity agreementAffinity agreement
Affinity agreement
 
NYP RA and CAP april 2016
NYP RA and CAP april 2016 NYP RA and CAP april 2016
NYP RA and CAP april 2016
 
Cancer Care Group HIPAA Settlement Agreement
Cancer Care Group HIPAA Settlement AgreementCancer Care Group HIPAA Settlement Agreement
Cancer Care Group HIPAA Settlement Agreement
 
HONI HIPAA Breach Resolution Agreement
HONI HIPAA Breach Resolution AgreementHONI HIPAA Breach Resolution Agreement
HONI HIPAA Breach Resolution Agreement
 
HIPAA Settlement New York Presbyterian and Columbia Universtiy
HIPAA Settlement New York Presbyterian and Columbia UniverstiyHIPAA Settlement New York Presbyterian and Columbia Universtiy
HIPAA Settlement New York Presbyterian and Columbia Universtiy
 
"Will Congress Fix The Stark Law Disclosure Dilemma?"
"Will Congress Fix The Stark Law Disclosure Dilemma?""Will Congress Fix The Stark Law Disclosure Dilemma?"
"Will Congress Fix The Stark Law Disclosure Dilemma?"
 
an_update_on_the_application_of_unfair_claims_settlement_practices
an_update_on_the_application_of_unfair_claims_settlement_practicesan_update_on_the_application_of_unfair_claims_settlement_practices
an_update_on_the_application_of_unfair_claims_settlement_practices
 
Oakland Housing Authority Legal Services Contract For General Counsel This
Oakland Housing Authority Legal Services Contract For General Counsel ThisOakland Housing Authority Legal Services Contract For General Counsel This
Oakland Housing Authority Legal Services Contract For General Counsel This
 
Broad Application of Medicare’s Mandatory Insurer Reporting Requirements to N...
Broad Application of Medicare’s Mandatory Insurer Reporting Requirements to N...Broad Application of Medicare’s Mandatory Insurer Reporting Requirements to N...
Broad Application of Medicare’s Mandatory Insurer Reporting Requirements to N...
 
Athletico presentation
Athletico presentationAthletico presentation
Athletico presentation
 
Item # 10 Catto & Catto to HUB Insurance Broker Assignment
Item # 10  Catto & Catto to HUB Insurance Broker AssignmentItem # 10  Catto & Catto to HUB Insurance Broker Assignment
Item # 10 Catto & Catto to HUB Insurance Broker Assignment
 
Kolbe v. Medical College Nov. 2009
Kolbe v. Medical College Nov. 2009Kolbe v. Medical College Nov. 2009
Kolbe v. Medical College Nov. 2009
 
Michele Isaak - Insolvent Estates
Michele Isaak - Insolvent EstatesMichele Isaak - Insolvent Estates
Michele Isaak - Insolvent Estates
 
Cancellation of removal in immigration court
Cancellation of removal in immigration courtCancellation of removal in immigration court
Cancellation of removal in immigration court
 
Unfair claims-settlement-practices-act
Unfair claims-settlement-practices-actUnfair claims-settlement-practices-act
Unfair claims-settlement-practices-act
 

Viewers also liked

презентація МАН.ppt
презентація МАН.pptпрезентація МАН.ppt
презентація МАН.pptfreedom_Z
 
Проект бази даних для автоматизації роботи шкільної бібліотеки (1).ppt
Проект бази даних для автоматизації роботи шкільної бібліотеки (1).pptПроект бази даних для автоматизації роботи шкільної бібліотеки (1).ppt
Проект бази даних для автоматизації роботи шкільної бібліотеки (1).pptfreedom_Z
 
Cfsis1401 fsi-spreadsheet178-public-06a
Cfsis1401 fsi-spreadsheet178-public-06aCfsis1401 fsi-spreadsheet178-public-06a
Cfsis1401 fsi-spreadsheet178-public-06analianalia
 
Amphenol LTW SSL 2.3 EZ-B
Amphenol LTW SSL 2.3 EZ-BAmphenol LTW SSL 2.3 EZ-B
Amphenol LTW SSL 2.3 EZ-BAmphenol LTW
 
LAS PRINCIPALES RELIGIONES DEL MUNDO: Ana
LAS PRINCIPALES RELIGIONES DEL MUNDO: AnaLAS PRINCIPALES RELIGIONES DEL MUNDO: Ana
LAS PRINCIPALES RELIGIONES DEL MUNDO: Anaprofesor1999
 
Ο Κοσμάς ο Αιτωλός
Ο Κοσμάς ο ΑιτωλόςΟ Κοσμάς ο Αιτωλός
Ο Κοσμάς ο ΑιτωλόςMaria Mot
 
Презентація до роботи.ppt
Презентація до роботи.pptПрезентація до роботи.ppt
Презентація до роботи.pptfreedom_Z
 
Amanda model 4bedrooms house and lot rush rush for sale in cavite
Amanda model 4bedrooms house and lot rush rush for sale in caviteAmanda model 4bedrooms house and lot rush rush for sale in cavite
Amanda model 4bedrooms house and lot rush rush for sale in caviteFreelance Real-Estate Practitioner
 

Viewers also liked (16)

Nurul asmi
Nurul asmiNurul asmi
Nurul asmi
 
Creches de sable1
Creches de sable1Creches de sable1
Creches de sable1
 
BWP 3Q14 result
BWP 3Q14 resultBWP 3Q14 result
BWP 3Q14 result
 
Jy is van rubber gemaak
Jy is van rubber gemaakJy is van rubber gemaak
Jy is van rubber gemaak
 
презентація МАН.ppt
презентація МАН.pptпрезентація МАН.ppt
презентація МАН.ppt
 
Σολων
ΣολωνΣολων
Σολων
 
Ζανζακ Ρουσσω
Ζανζακ ΡουσσωΖανζακ Ρουσσω
Ζανζακ Ρουσσω
 
Σολων
ΣολωνΣολων
Σολων
 
Проект бази даних для автоматизації роботи шкільної бібліотеки (1).ppt
Проект бази даних для автоматизації роботи шкільної бібліотеки (1).pptПроект бази даних для автоматизації роботи шкільної бібліотеки (1).ppt
Проект бази даних для автоматизації роботи шкільної бібліотеки (1).ppt
 
Cfsis1401 fsi-spreadsheet178-public-06a
Cfsis1401 fsi-spreadsheet178-public-06aCfsis1401 fsi-spreadsheet178-public-06a
Cfsis1401 fsi-spreadsheet178-public-06a
 
Amphenol LTW SSL 2.3 EZ-B
Amphenol LTW SSL 2.3 EZ-BAmphenol LTW SSL 2.3 EZ-B
Amphenol LTW SSL 2.3 EZ-B
 
Oso pardo
Oso pardoOso pardo
Oso pardo
 
LAS PRINCIPALES RELIGIONES DEL MUNDO: Ana
LAS PRINCIPALES RELIGIONES DEL MUNDO: AnaLAS PRINCIPALES RELIGIONES DEL MUNDO: Ana
LAS PRINCIPALES RELIGIONES DEL MUNDO: Ana
 
Ο Κοσμάς ο Αιτωλός
Ο Κοσμάς ο ΑιτωλόςΟ Κοσμάς ο Αιτωλός
Ο Κοσμάς ο Αιτωλός
 
Презентація до роботи.ppt
Презентація до роботи.pptПрезентація до роботи.ppt
Презентація до роботи.ppt
 
Amanda model 4bedrooms house and lot rush rush for sale in cavite
Amanda model 4bedrooms house and lot rush rush for sale in caviteAmanda model 4bedrooms house and lot rush rush for sale in cavite
Amanda model 4bedrooms house and lot rush rush for sale in cavite
 

Similar to Shasta agreement

Catholic Health Care Services Resolution Agreement
Catholic Health Care Services Resolution Agreement Catholic Health Care Services Resolution Agreement
Catholic Health Care Services Resolution Agreement data brackets
 
HIPAA Violation Fines: North memorial Hospistal Settlement
 HIPAA Violation Fines: North memorial Hospistal Settlement  HIPAA Violation Fines: North memorial Hospistal Settlement
HIPAA Violation Fines: North memorial Hospistal Settlement data brackets
 
North memorial resolution agreement
North memorial resolution agreementNorth memorial resolution agreement
North memorial resolution agreementAlex Slaney
 
NYP RA and Cap april 2016
NYP RA and Cap april 2016 NYP RA and Cap april 2016
NYP RA and Cap april 2016 data brackets
 
Raleigh Orthopedic RA and CAP April 2016
Raleigh Orthopedic RA and CAP April 2016Raleigh Orthopedic RA and CAP April 2016
Raleigh Orthopedic RA and CAP April 2016data brackets
 
First HIPAA enforcement action for lack of timely breach notification settles...
First HIPAA enforcement action for lack of timely breach notification settles...First HIPAA enforcement action for lack of timely breach notification settles...
First HIPAA enforcement action for lack of timely breach notification settles...David Sweigert
 
Presence Health Resolution Agreement with OCR
Presence Health Resolution Agreement with OCRPresence Health Resolution Agreement with OCR
Presence Health Resolution Agreement with OCRdata brackets
 
Skagit county- HIPAA violation settlement agreement with HHS
Skagit county- HIPAA violation settlement agreement with HHSSkagit county- HIPAA violation settlement agreement with HHS
Skagit county- HIPAA violation settlement agreement with HHSdata brackets
 
17 stipulation to dismiss with prejudice and order
17 stipulation to dismiss with prejudice and order17 stipulation to dismiss with prejudice and order
17 stipulation to dismiss with prejudice and orderHonolulu Civil Beat
 
UB04 EXAMPLE JONES
UB04 EXAMPLE JONESUB04 EXAMPLE JONES
UB04 EXAMPLE JONESEbony Holden
 
Mediation Order New England Compounding Pharmacy
Mediation Order New England Compounding Pharmacy Mediation Order New England Compounding Pharmacy
Mediation Order New England Compounding Pharmacy mzamoralaw
 
Privacy update 04.29.2010
Privacy update 04.29.2010Privacy update 04.29.2010
Privacy update 04.29.2010stevemeltzer
 
1500 EXAMPLE JONES
1500 EXAMPLE JONES1500 EXAMPLE JONES
1500 EXAMPLE JONESEbony Holden
 
Bussiness associate agreementba 100213173228-phpapp02
Bussiness associate agreementba 100213173228-phpapp02Bussiness associate agreementba 100213173228-phpapp02
Bussiness associate agreementba 100213173228-phpapp02Donald M. Kaesser
 
FCS 3450 HOMEWORK #41.Thomas Franklin arrived at the following t.docx
FCS 3450 HOMEWORK #41.Thomas Franklin arrived at the following t.docxFCS 3450 HOMEWORK #41.Thomas Franklin arrived at the following t.docx
FCS 3450 HOMEWORK #41.Thomas Franklin arrived at the following t.docxmydrynan
 
http1500cms.comBECAUSE THIS FORM IS USED BY VARIOUS .docx
http1500cms.comBECAUSE THIS FORM IS USED BY VARIOUS .docxhttp1500cms.comBECAUSE THIS FORM IS USED BY VARIOUS .docx
http1500cms.comBECAUSE THIS FORM IS USED BY VARIOUS .docxpooleavelina
 
Participation Agreement
Participation AgreementParticipation Agreement
Participation Agreementrelevatetech
 
LIT_AprilMay2014_FalseClaimsActFeature
LIT_AprilMay2014_FalseClaimsActFeatureLIT_AprilMay2014_FalseClaimsActFeature
LIT_AprilMay2014_FalseClaimsActFeatureNadya Salcedo
 

Similar to Shasta agreement (20)

Catholic Health Care Services Resolution Agreement
Catholic Health Care Services Resolution Agreement Catholic Health Care Services Resolution Agreement
Catholic Health Care Services Resolution Agreement
 
HIPAA Violation Fines: North memorial Hospistal Settlement
 HIPAA Violation Fines: North memorial Hospistal Settlement  HIPAA Violation Fines: North memorial Hospistal Settlement
HIPAA Violation Fines: North memorial Hospistal Settlement
 
North memorial resolution agreement
North memorial resolution agreementNorth memorial resolution agreement
North memorial resolution agreement
 
NYP RA and Cap april 2016
NYP RA and Cap april 2016 NYP RA and Cap april 2016
NYP RA and Cap april 2016
 
Raleigh Orthopedic RA and CAP April 2016
Raleigh Orthopedic RA and CAP April 2016Raleigh Orthopedic RA and CAP April 2016
Raleigh Orthopedic RA and CAP April 2016
 
First HIPAA enforcement action for lack of timely breach notification settles...
First HIPAA enforcement action for lack of timely breach notification settles...First HIPAA enforcement action for lack of timely breach notification settles...
First HIPAA enforcement action for lack of timely breach notification settles...
 
Presence Health Resolution Agreement with OCR
Presence Health Resolution Agreement with OCRPresence Health Resolution Agreement with OCR
Presence Health Resolution Agreement with OCR
 
Skagit county- HIPAA violation settlement agreement with HHS
Skagit county- HIPAA violation settlement agreement with HHSSkagit county- HIPAA violation settlement agreement with HHS
Skagit county- HIPAA violation settlement agreement with HHS
 
17 stipulation to dismiss with prejudice and order
17 stipulation to dismiss with prejudice and order17 stipulation to dismiss with prejudice and order
17 stipulation to dismiss with prejudice and order
 
UB04 EXAMPLE JONES
UB04 EXAMPLE JONESUB04 EXAMPLE JONES
UB04 EXAMPLE JONES
 
Rokita Non-Disclosure Agreement
Rokita Non-Disclosure AgreementRokita Non-Disclosure Agreement
Rokita Non-Disclosure Agreement
 
Mediation Order New England Compounding Pharmacy
Mediation Order New England Compounding Pharmacy Mediation Order New England Compounding Pharmacy
Mediation Order New England Compounding Pharmacy
 
Privacy update 04.29.2010
Privacy update 04.29.2010Privacy update 04.29.2010
Privacy update 04.29.2010
 
1500 EXAMPLE JONES
1500 EXAMPLE JONES1500 EXAMPLE JONES
1500 EXAMPLE JONES
 
Bussiness associate agreementba 100213173228-phpapp02
Bussiness associate agreementba 100213173228-phpapp02Bussiness associate agreementba 100213173228-phpapp02
Bussiness associate agreementba 100213173228-phpapp02
 
FCS 3450 HOMEWORK #41.Thomas Franklin arrived at the following t.docx
FCS 3450 HOMEWORK #41.Thomas Franklin arrived at the following t.docxFCS 3450 HOMEWORK #41.Thomas Franklin arrived at the following t.docx
FCS 3450 HOMEWORK #41.Thomas Franklin arrived at the following t.docx
 
Acordo odebrecht-doj-merged
Acordo odebrecht-doj-mergedAcordo odebrecht-doj-merged
Acordo odebrecht-doj-merged
 
http1500cms.comBECAUSE THIS FORM IS USED BY VARIOUS .docx
http1500cms.comBECAUSE THIS FORM IS USED BY VARIOUS .docxhttp1500cms.comBECAUSE THIS FORM IS USED BY VARIOUS .docx
http1500cms.comBECAUSE THIS FORM IS USED BY VARIOUS .docx
 
Participation Agreement
Participation AgreementParticipation Agreement
Participation Agreement
 
LIT_AprilMay2014_FalseClaimsActFeature
LIT_AprilMay2014_FalseClaimsActFeatureLIT_AprilMay2014_FalseClaimsActFeature
LIT_AprilMay2014_FalseClaimsActFeature
 

More from data brackets

Prepayment Audit Suggested Documentation
Prepayment Audit Suggested DocumentationPrepayment Audit Suggested Documentation
Prepayment Audit Suggested Documentationdata brackets
 
Lincare HIPAA remediated decision by administrative judge
Lincare HIPAA remediated decision by administrative judgeLincare HIPAA remediated decision by administrative judge
Lincare HIPAA remediated decision by administrative judgedata brackets
 
Lincare HIPAA Notice of Proposed Determination remediated
Lincare HIPAA Notice of Proposed Determination remediatedLincare HIPAA Notice of Proposed Determination remediated
Lincare HIPAA Notice of Proposed Determination remediateddata brackets
 
Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule and ...
Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule and ...Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule and ...
Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule and ...data brackets
 
Office of Inspector General Study on OCR's HIPAA audit program
Office of Inspector General Study on OCR's HIPAA audit programOffice of Inspector General Study on OCR's HIPAA audit program
Office of Inspector General Study on OCR's HIPAA audit programdata brackets
 
EHR meaningful use security risk assessment sample document
EHR meaningful use security risk assessment sample documentEHR meaningful use security risk assessment sample document
EHR meaningful use security risk assessment sample documentdata brackets
 
OCR HHS HIPAA HITECH Audit Advisory Template
OCR HHS HIPAA HITECH Audit Advisory TemplateOCR HHS HIPAA HITECH Audit Advisory Template
OCR HHS HIPAA HITECH Audit Advisory Templatedata brackets
 
HIPAA HITECH Compliance Assurance Template
HIPAA HITECH Compliance Assurance TemplateHIPAA HITECH Compliance Assurance Template
HIPAA HITECH Compliance Assurance Templatedata brackets
 
Trends and Career Opportunities in Health IT
Trends and Career Opportunities in Health ITTrends and Career Opportunities in Health IT
Trends and Career Opportunities in Health ITdata brackets
 
Massachusetts Eye and Ear Infirmary HIPAA Violation
Massachusetts Eye and Ear Infirmary HIPAA  ViolationMassachusetts Eye and Ear Infirmary HIPAA  Violation
Massachusetts Eye and Ear Infirmary HIPAA Violationdata brackets
 
Mobile devices and applications in healthcare: Security and Compliance Risks
Mobile devices and applications in healthcare: Security and Compliance RisksMobile devices and applications in healthcare: Security and Compliance Risks
Mobile devices and applications in healthcare: Security and Compliance Risksdata brackets
 
Business Associate Assurance: What Covered Entities Need to Know
Business Associate Assurance: What Covered Entities Need to KnowBusiness Associate Assurance: What Covered Entities Need to Know
Business Associate Assurance: What Covered Entities Need to Knowdata brackets
 
Social Media Compliance for Healthcare Professionals
Social Media Compliance for Healthcare ProfessionalsSocial Media Compliance for Healthcare Professionals
Social Media Compliance for Healthcare Professionalsdata brackets
 
HIPAA HiTech Security Assessment
HIPAA HiTech Security AssessmentHIPAA HiTech Security Assessment
HIPAA HiTech Security Assessmentdata brackets
 

More from data brackets (14)

Prepayment Audit Suggested Documentation
Prepayment Audit Suggested DocumentationPrepayment Audit Suggested Documentation
Prepayment Audit Suggested Documentation
 
Lincare HIPAA remediated decision by administrative judge
Lincare HIPAA remediated decision by administrative judgeLincare HIPAA remediated decision by administrative judge
Lincare HIPAA remediated decision by administrative judge
 
Lincare HIPAA Notice of Proposed Determination remediated
Lincare HIPAA Notice of Proposed Determination remediatedLincare HIPAA Notice of Proposed Determination remediated
Lincare HIPAA Notice of Proposed Determination remediated
 
Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule and ...
Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule and ...Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule and ...
Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule and ...
 
Office of Inspector General Study on OCR's HIPAA audit program
Office of Inspector General Study on OCR's HIPAA audit programOffice of Inspector General Study on OCR's HIPAA audit program
Office of Inspector General Study on OCR's HIPAA audit program
 
EHR meaningful use security risk assessment sample document
EHR meaningful use security risk assessment sample documentEHR meaningful use security risk assessment sample document
EHR meaningful use security risk assessment sample document
 
OCR HHS HIPAA HITECH Audit Advisory Template
OCR HHS HIPAA HITECH Audit Advisory TemplateOCR HHS HIPAA HITECH Audit Advisory Template
OCR HHS HIPAA HITECH Audit Advisory Template
 
HIPAA HITECH Compliance Assurance Template
HIPAA HITECH Compliance Assurance TemplateHIPAA HITECH Compliance Assurance Template
HIPAA HITECH Compliance Assurance Template
 
Trends and Career Opportunities in Health IT
Trends and Career Opportunities in Health ITTrends and Career Opportunities in Health IT
Trends and Career Opportunities in Health IT
 
Massachusetts Eye and Ear Infirmary HIPAA Violation
Massachusetts Eye and Ear Infirmary HIPAA  ViolationMassachusetts Eye and Ear Infirmary HIPAA  Violation
Massachusetts Eye and Ear Infirmary HIPAA Violation
 
Mobile devices and applications in healthcare: Security and Compliance Risks
Mobile devices and applications in healthcare: Security and Compliance RisksMobile devices and applications in healthcare: Security and Compliance Risks
Mobile devices and applications in healthcare: Security and Compliance Risks
 
Business Associate Assurance: What Covered Entities Need to Know
Business Associate Assurance: What Covered Entities Need to KnowBusiness Associate Assurance: What Covered Entities Need to Know
Business Associate Assurance: What Covered Entities Need to Know
 
Social Media Compliance for Healthcare Professionals
Social Media Compliance for Healthcare ProfessionalsSocial Media Compliance for Healthcare Professionals
Social Media Compliance for Healthcare Professionals
 
HIPAA HiTech Security Assessment
HIPAA HiTech Security AssessmentHIPAA HiTech Security Assessment
HIPAA HiTech Security Assessment
 

Recently uploaded

Glomerular Filtration and determinants of glomerular filtration .pptx
Glomerular Filtration and  determinants of glomerular filtration .pptxGlomerular Filtration and  determinants of glomerular filtration .pptx
Glomerular Filtration and determinants of glomerular filtration .pptxDr.Nusrat Tariq
 
Culture and Health Disorders Social change.pptx
Culture and Health Disorders Social change.pptxCulture and Health Disorders Social change.pptx
Culture and Health Disorders Social change.pptxDr. Dheeraj Kumar
 
epilepsy and status epilepticus for undergraduate.pptx
epilepsy and status epilepticus  for undergraduate.pptxepilepsy and status epilepticus  for undergraduate.pptx
epilepsy and status epilepticus for undergraduate.pptxMohamed Rizk Khodair
 
PULMONARY EMBOLISM AND ITS MANAGEMENTS.pdf
PULMONARY EMBOLISM AND ITS MANAGEMENTS.pdfPULMONARY EMBOLISM AND ITS MANAGEMENTS.pdf
PULMONARY EMBOLISM AND ITS MANAGEMENTS.pdfDolisha Warbi
 
Wessex Health Partners Wessex Integrated Care, Population Health, Research & ...
Wessex Health Partners Wessex Integrated Care, Population Health, Research & ...Wessex Health Partners Wessex Integrated Care, Population Health, Research & ...
Wessex Health Partners Wessex Integrated Care, Population Health, Research & ...Wessex Health Partners
 
call girls in aerocity DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️
call girls in aerocity DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️call girls in aerocity DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️
call girls in aerocity DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️saminamagar
 
Big Data Analysis Suggests COVID Vaccination Increases Excess Mortality Of ...
Big Data Analysis Suggests COVID  Vaccination Increases Excess Mortality Of  ...Big Data Analysis Suggests COVID  Vaccination Increases Excess Mortality Of  ...
Big Data Analysis Suggests COVID Vaccination Increases Excess Mortality Of ...sdateam0
 
call girls in munirka DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️
call girls in munirka  DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️call girls in munirka  DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️
call girls in munirka DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️saminamagar
 
Presentation on General Anesthetics pdf.
Presentation on General Anesthetics pdf.Presentation on General Anesthetics pdf.
Presentation on General Anesthetics pdf.Prerana Jadhav
 
Glomerular Filtration rate and its determinants.pptx
Glomerular Filtration rate and its determinants.pptxGlomerular Filtration rate and its determinants.pptx
Glomerular Filtration rate and its determinants.pptxDr.Nusrat Tariq
 
Lippincott Microcards_ Microbiology Flash Cards-LWW (2015).pdf
Lippincott Microcards_ Microbiology Flash Cards-LWW (2015).pdfLippincott Microcards_ Microbiology Flash Cards-LWW (2015).pdf
Lippincott Microcards_ Microbiology Flash Cards-LWW (2015).pdfSreeja Cherukuru
 
Primary headache and facial pain. (2024)
Primary headache and facial pain. (2024)Primary headache and facial pain. (2024)
Primary headache and facial pain. (2024)Mohamed Rizk Khodair
 
VarSeq 2.6.0: Advancing Pharmacogenomics and Genomic Analysis
VarSeq 2.6.0: Advancing Pharmacogenomics and Genomic AnalysisVarSeq 2.6.0: Advancing Pharmacogenomics and Genomic Analysis
VarSeq 2.6.0: Advancing Pharmacogenomics and Genomic AnalysisGolden Helix
 
call girls in Dwarka Sector 21 Metro DELHI 🔝 >༒9540349809 🔝 genuine Escort Se...
call girls in Dwarka Sector 21 Metro DELHI 🔝 >༒9540349809 🔝 genuine Escort Se...call girls in Dwarka Sector 21 Metro DELHI 🔝 >༒9540349809 🔝 genuine Escort Se...
call girls in Dwarka Sector 21 Metro DELHI 🔝 >༒9540349809 🔝 genuine Escort Se...saminamagar
 
Statistical modeling in pharmaceutical research and development.
Statistical modeling in pharmaceutical research and development.Statistical modeling in pharmaceutical research and development.
Statistical modeling in pharmaceutical research and development.ANJALI
 
Apiculture Chapter 1. Introduction 2.ppt
Apiculture Chapter 1. Introduction 2.pptApiculture Chapter 1. Introduction 2.ppt
Apiculture Chapter 1. Introduction 2.pptkedirjemalharun
 
PULMONARY EDEMA AND ITS MANAGEMENT.pdf
PULMONARY EDEMA AND  ITS  MANAGEMENT.pdfPULMONARY EDEMA AND  ITS  MANAGEMENT.pdf
PULMONARY EDEMA AND ITS MANAGEMENT.pdfDolisha Warbi
 
call girls in paharganj DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️
call girls in paharganj DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️call girls in paharganj DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️
call girls in paharganj DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️saminamagar
 
Presentation on Parasympathetic Nervous System
Presentation on Parasympathetic Nervous SystemPresentation on Parasympathetic Nervous System
Presentation on Parasympathetic Nervous SystemPrerana Jadhav
 

Recently uploaded (20)

Glomerular Filtration and determinants of glomerular filtration .pptx
Glomerular Filtration and  determinants of glomerular filtration .pptxGlomerular Filtration and  determinants of glomerular filtration .pptx
Glomerular Filtration and determinants of glomerular filtration .pptx
 
Culture and Health Disorders Social change.pptx
Culture and Health Disorders Social change.pptxCulture and Health Disorders Social change.pptx
Culture and Health Disorders Social change.pptx
 
epilepsy and status epilepticus for undergraduate.pptx
epilepsy and status epilepticus  for undergraduate.pptxepilepsy and status epilepticus  for undergraduate.pptx
epilepsy and status epilepticus for undergraduate.pptx
 
PULMONARY EMBOLISM AND ITS MANAGEMENTS.pdf
PULMONARY EMBOLISM AND ITS MANAGEMENTS.pdfPULMONARY EMBOLISM AND ITS MANAGEMENTS.pdf
PULMONARY EMBOLISM AND ITS MANAGEMENTS.pdf
 
Wessex Health Partners Wessex Integrated Care, Population Health, Research & ...
Wessex Health Partners Wessex Integrated Care, Population Health, Research & ...Wessex Health Partners Wessex Integrated Care, Population Health, Research & ...
Wessex Health Partners Wessex Integrated Care, Population Health, Research & ...
 
call girls in aerocity DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️
call girls in aerocity DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️call girls in aerocity DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️
call girls in aerocity DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️
 
Big Data Analysis Suggests COVID Vaccination Increases Excess Mortality Of ...
Big Data Analysis Suggests COVID  Vaccination Increases Excess Mortality Of  ...Big Data Analysis Suggests COVID  Vaccination Increases Excess Mortality Of  ...
Big Data Analysis Suggests COVID Vaccination Increases Excess Mortality Of ...
 
call girls in munirka DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️
call girls in munirka  DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️call girls in munirka  DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️
call girls in munirka DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️
 
Epilepsy
EpilepsyEpilepsy
Epilepsy
 
Presentation on General Anesthetics pdf.
Presentation on General Anesthetics pdf.Presentation on General Anesthetics pdf.
Presentation on General Anesthetics pdf.
 
Glomerular Filtration rate and its determinants.pptx
Glomerular Filtration rate and its determinants.pptxGlomerular Filtration rate and its determinants.pptx
Glomerular Filtration rate and its determinants.pptx
 
Lippincott Microcards_ Microbiology Flash Cards-LWW (2015).pdf
Lippincott Microcards_ Microbiology Flash Cards-LWW (2015).pdfLippincott Microcards_ Microbiology Flash Cards-LWW (2015).pdf
Lippincott Microcards_ Microbiology Flash Cards-LWW (2015).pdf
 
Primary headache and facial pain. (2024)
Primary headache and facial pain. (2024)Primary headache and facial pain. (2024)
Primary headache and facial pain. (2024)
 
VarSeq 2.6.0: Advancing Pharmacogenomics and Genomic Analysis
VarSeq 2.6.0: Advancing Pharmacogenomics and Genomic AnalysisVarSeq 2.6.0: Advancing Pharmacogenomics and Genomic Analysis
VarSeq 2.6.0: Advancing Pharmacogenomics and Genomic Analysis
 
call girls in Dwarka Sector 21 Metro DELHI 🔝 >༒9540349809 🔝 genuine Escort Se...
call girls in Dwarka Sector 21 Metro DELHI 🔝 >༒9540349809 🔝 genuine Escort Se...call girls in Dwarka Sector 21 Metro DELHI 🔝 >༒9540349809 🔝 genuine Escort Se...
call girls in Dwarka Sector 21 Metro DELHI 🔝 >༒9540349809 🔝 genuine Escort Se...
 
Statistical modeling in pharmaceutical research and development.
Statistical modeling in pharmaceutical research and development.Statistical modeling in pharmaceutical research and development.
Statistical modeling in pharmaceutical research and development.
 
Apiculture Chapter 1. Introduction 2.ppt
Apiculture Chapter 1. Introduction 2.pptApiculture Chapter 1. Introduction 2.ppt
Apiculture Chapter 1. Introduction 2.ppt
 
PULMONARY EDEMA AND ITS MANAGEMENT.pdf
PULMONARY EDEMA AND  ITS  MANAGEMENT.pdfPULMONARY EDEMA AND  ITS  MANAGEMENT.pdf
PULMONARY EDEMA AND ITS MANAGEMENT.pdf
 
call girls in paharganj DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️
call girls in paharganj DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️call girls in paharganj DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️
call girls in paharganj DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️
 
Presentation on Parasympathetic Nervous System
Presentation on Parasympathetic Nervous SystemPresentation on Parasympathetic Nervous System
Presentation on Parasympathetic Nervous System
 

Shasta agreement

  • 1. RESOLUTION AGREEMENT I. Recitals 1. Parties. The Parties to this Resolution Agreement (“Agreement”) are the United States Department of Health and Human Services, Office for Civil Rights (“HHS”) and Shasta Regional Medical Center (“SRMC”) and all other facilities listed in Appendix B hereinafter referred to collectively in this Agreement as “Covered Entities”. Appendix B, listing Shasta Regional Medical Center and all other facilities currently under the same ownership or operational control that meet the definition of a “health care provider” and “covered entity” as defined in 45 C.F.R. Section 160.103, is incorporated in to this Resolution Agreement by reference. 2. A. Authority of HHS Factual Background and Covered Conduct HHS enforces the Federal Standards for Privacy of Individually Identifiable Health Information (45 C.F.R. Part 160 and Subparts A and E of Part 164, the “Privacy Rule”) and the Federal Security Standards for the Protection of Electronic Protected Health Information (45 C.F.R. Part 160 and Subparts A and C of Part 164, the “Security Rule”). HHS has the authority to conduct investigations of complaints alleging violations of the Privacy and Security Rules by covered entities, and a covered entity must cooperate with HHS’s investigation. 45 C.F.R. §§160.306(c) and 160.310(b). B. Covered Entities SRMC and other facilities currently under the same ownership or operational control listed in Appendix B are health care providers as defined at 45 C.F.R. §160.103 that transmit health information in electronic form in connection with a transaction covered by 45 C.F.R. Part 162 and therefore are covered entities required to comply with the Privacy Rule. C. Covered Conduct On January 6, 2012, HHS notified SRMC of its initiation of a compliance review of its facility to determine whether there was a failure to comply with the requirements of the Privacy Rule. HHS’s compliance review was prompted by an article in the Los Angeles Times published on January 4, 2012. The article indicated that two of SRMC’s senior leaders met with the media to discuss the medical services provided to a patient (the Affected Party) without a valid written authorization.
  • 2. Page 2 HHS’s investigation indicated that the following conduct occurred (“Covered Conduct”): a) From December 13 – 20, 2011, SRMC failed to safeguard the Affected Party’s PHI from any impermissible intentional or unintentional disclosure on multiple occasions as described below. This failure was evidenced by the following facts: i) On December 13, 2011, SRMC sent a letter, through its parent company, to California Watch, responding to a story concerning Medicare fraud. The letter described the Affected Party’s medical treatment and provided specifics about her lab results. SRMC did not have a written authorization from the Affected Party to disclose this information to this news outlet. ii) On December 16, 2011, two of SRMC’s senior leaders met with The Record Searchlight’s editor to discuss the Affected Party’s medical record in detail. SRMC did not have a written authorization from the Affected Party to disclose this information to this newspaper. iii) On December 20, 2011, SRMC sent a letter to The Los Angeles Times, which contained detailed information about the treatment the Affected Party received. SRMC did not have a written authorization from the Affected Party to disclose this information to this newspaper. b) SRMC impermissibly used the affected party’s PHI. This failure was evidenced by the following facts: i) On December 20, 2011, SRMC sent an email to its entire workforce and medical staff, approximately 785-900 individuals, describing, in detail, the Affected Party’s medical condition, diagnosis and treatment. SRMC did not have a written authorization from the Affected Party to share this information with SRMC’s entire workforce and medical staff. c) SRMC has failed to sanction its workforce members pursuant to its internal sanctions policy which requires that it sanction employees for “violations of HIPAA”. 3. No Admission. This Agreement is not an admission of liability by Covered Entities. 4. No Concession. This Agreement is not a concession by HHS that Covered Entities are not in violation of the Privacy Rule and not liable for civil money penalties. 5. Intention of Parties to Effect Resolution. This Agreement is intended to resolve the Compliance Review 12-137198 regarding possible violations of the Privacy Rule promulgated by HHS pursuant to the administrative simplification provisions of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Pub.L. 104-191, 110 Stat. 1936. In consideration of the Parties’ interest in avoiding the uncertainty, burden, and expense of further investigation and formal proceedings, the Parties agree to resolve this matter according to the Terms and Conditions below.
  • 3. Page 3 II. Terms and Conditions 6. Compliance Representative. Each facility listed in Appendix B other than SRMC, shall designate an individual to serve as its Compliance Representative under this Agreement and under the Corrective Action Plan (CAP). These facilities agree to appoint a single individual to serve as the Compliance Representative for each of them. The Covered Entities shall provide OCR on the Effective Date with the name of the Compliance Representative. The Compliance Representative, in regard to the facilities listed in Appendix B other than SRMC, shall be the Contact Person and signatory under this Agreement and CAP, and shall be responsible for ensuring compliance with the Agreement and CAP. 7. Payment. Covered Entities agree to pay HHS the amount of Two Hundred and Seventy Five Thousand Dollars ($275,000.00) as the Resolution Amount. Covered Entities agree to pay the Resolution Amount by electronic funds transfer pursuant to written instructions to be provided by HHS. Covered Entities agree to make this payment on or before the date it signs this Agreement. 8. Corrective Action Plan. Covered Entities have entered into and agree to comply with the Corrective Action Plan (CAP), attached as Appendix A, which is incorporated into this Agreement by reference. If SRMC or any facility listed in Appendix B breaches the CAP, and fails to cure the breach as set forth in the CAP, then Covered Entities will be in breach of this Agreement and HHS will not be subject to the Release set forth in paragraph 9 of this Agreement. 9. Release by HHS. In consideration of and conditioned upon Covered Entities’ performance of all of its obligations under this Agreement, HHS releases Covered Entities from any actions it may have under the Privacy Rule for the covered conduct indentified in paragraph 2. HHS does not release Covered Entities from, nor waive any rights, obligations, or causes of action other than those specifically referred to in this paragraph. This release does not extend to actions that may be brought under Section 1177 of the Social Security Act, 42 U.S.C. § 1320d-6. 10. . Covered Entities shall not contest the validity of its obligation to pay, nor the amount of, the Resolution Amount or any other obligations agreed to under this Agreement. Covered Entities waive all procedural rights granted under Section 1128A of the Social Security Act (42 U.S.C. § 1320a- 7a) and 45 C.F.R. Part 160 Subpart E, and HHS claims collection regulations at 45 C.F.R. Part 30, including, but not limited to, notice, hearing, and appeal with respect to the Resolution Amount. 11. Binding on Successors. This Agreement is binding on Covered Entities and their successors, heirs, and transferees. // Agreement by Released Party
  • 4. Page 4 12. Costs. Each Party to this Agreement shall bear its own legal and other costs incurred in connection with this matter, including the preparation and performance of this Agreement. 13. No Additional Releases. This Agreement is intended to be for the benefit of the Parties only and, by this instrument, the Parties do not release any claims against any other person or entity. 14. Effect of Agreement. This Agreement constitutes the complete agreement between the Parties. All material representations, understandings, and promises of the Parties are contained in this Agreement. Any modifications to this Agreement must be set forth in writing and signed by all Parties. 15. Execution of Agreement and Effective Date. This Agreement shall become effective (i.e., final and binding) upon the date of signing this Agreement and the CAP by the last signatory (Effective Date). 16. Tolling of Statute of Limitations. Pursuant to 42 U.S.C. § 1320a-7a(c) (1), a civil money penalty (CMP) must be imposed within six (6) years from the date of the occurrence of the violation. To ensure that this six-year period does not expire during the term of this Agreement, Covered Entities agree that the time between the Effective Date of this Agreement (as set forth in paragraph 14) and the date that same may be terminated by reason of the Covered Entities’ breach, plus one-year thereafter, will not be included in calculating the six (6) year statute of limitations applicable to the violations which are the subject of this Agreement. Covered Entities waive and will not plead, any statute of limitations, laches, or similar defenses to any administrative action relating to the Covered Conduct identified in paragraph 2 of this Agreement that may be filed by HHS within the time period set forth above, except to the extent that such defenses would have been available had an administrative action been filed on the Effective Date of this Resolution Agreement. 17. Disclosure. There are no restrictions on the publication of the Agreement. This Agreement and information related to this Agreement may be made public by either party. In addition, HHS may be required to disclose this Agreement and related material to any person upon request consistent with the applicable provisions of the Freedom of Information Act, 5 U.S.C. § 552, and its implementing regulations, 45 C.F.R. Part 5. 18. Execution in Counterparts. This Agreement may be executed in counterparts, each of which constitutes an original, and all of which shall constitute one and the same agreement. // //
  • 5. Page 5 19. Authorizations. The individual(s) signing this Agreement on behalf of Covered Entities represent and warrant that they are authorized by Covered Entities to execute this Agreement. The individual(s) signing this Agreement on behalf of HHS represent and warrant that they are signing this Agreement in their official capacities and that they are authorized to execute this Agreement For Covered Entities /s/ 05/31/2013 ____________________________ ____________ Randall Hempling Date Chief Executive Officer Shasta Regional Medical Center /s/ 06/03/2013 _____________________________ ______________ Chris Doan Date Chief Compliance Officer Prime Healthcare Management, Inc. For U.S. Department of Health and Human Services /s/ 06/06/2013 ____________________________ _____________ Michael Leoz Date Regional Manager, Region IX U.S. Department of Health and Human Service Office for Civil Rights
  • 6. Page 6 Appendix A CORRECTIVE ACTION PLAN BETWEEN THE DEPARTMENT OF HEALTH AND HUMAN SERVICES AND SHASTA REGIONAL MEDICAL CENTER AND FACILITIES LISTED IN APPENDIX B I. Preamble The parties to this Resolution Agreement, Shasta Regional Medical Center (“SRMC”), and all other facilities listed in Appendix B, are hereinafter referred to collectively as “Covered Entities”. Covered Entities hereby enter into this Corrective Action Plan ("CAP") with the United States Department of Health and Human Services, Office for Civil Rights ("HHS"). Contemporaneously with this CAP, Covered Entities are entering into a Resolution Agreement ("Agreement") with HHS, and this CAP is incorporated by reference into the Agreement as Appendix A. Appendix B, listing Shasta Regional Medical Center and all other facilities. currently under the same ownership or operational control that meet the definition of a “health care provider” and “covered entity” as defined in 45 C.F.R. Section 160.103, is incorporated in to this Resolution Agreement by reference. Covered Entities enter into this CAP as consideration for the release set forth in paragraph 9 of the Agreement. II. Contact Persons and Submissions A. Covered Entities have identified the following individuals as their authorized representative and contact person regarding the implementation of this CAP and for receipt and submission of notifications and reports: Contact Persons For SRMC: Randall Hempling Chief Executive Officer Shasta Regional Medical Center 1100 Butte Street Redding, CA 96049 Telephone: (530) 244-5400 Facsimile: (530)-244-5119
  • 7. Page 7 Compliance Representative for other Covered Entities listed in Appendix B: Chris Doan Chief Compliance Officer Prime Healthcare Management, Inc. 3300 Guasti Road Ontario, CA 91761 Telephone: (909) 235-4400 Facsimile: (909) 235-4419 HHS has identified the following individual as its authorized representative and contact person to whom the Covered Entities are to report information regarding the implementation of this CAP: Michael Leoz, Regional Manager Office for Civil Rights, Region IX U.S. Department of Health and Human Services 90 7th Street, Suite 4-100 San Francisco, CA 94103 Telephone: (415) 437-8310 Facsimile: (415) 437-8329 Covered Entities and HHS agree to promptly notify each other of any changes in the contact persons or the other information provided above. B. Proof of Submissions. Unless otherwise specified, all notifications and reports required by this CAP may be made by any means, including certified mail, overnight mail, or hand delivery, provided that there is proof that such notification was received. For purposes of this requirement, internal facsimile confirmation sheets do not constitute proof of receipt. III. Term of CAP The period of compliance obligations assumed by Covered Entities under this CAP shall be one (1) year from the effective date of this CAP (“Effective Date”), except that, after this period, Covered Entities shall be obligated to: comply with the document retention requirement set forth in section VIII. The Effective Date of this CAP shall be calculated in accordance with paragraph 15 of the Agreement. IV. Time In computing any period of time prescribed or allowed by this CAP, the day of the act, event, or default from which the designated period of time begins to run shall not be included. The last day of the period so computed shall be included, unless it is a Saturday, a Sunday, or a
  • 8. Page 8 legal holiday, in which event the period runs until the end of the next day that is not one of the aforementioned days. V. Shasta Regional Medical Center Corrective Action Obligations Shasta Regional Medical Center, agrees to the following: A. Policies and Procedures 1. SRMC shall develop, maintain and revise, as necessary, its written policies and procedures (“Policies and Procedures”) applicable to all of its facilities and subsidiaries to comply with the Federal standards that govern the privacy of individually identifiable health information (45 C.F.R. Part 160 and Subparts A and E of Part 164, the “Privacy Rule”). SRMC’s Policies and Procedures shall include, but not be limited to, the minimum content set forth in section V.C. below. 2. SRMC shall provide such Policies and Procedures consistent with paragraph 1 above, to HHS within ninety (90) calendar days of the Effective Date for review and approval. Upon receiving any recommended changes to such Policies and Procedures from HHS, SRMC shall have sixty (60) calendar days to revise such Policies and Procedures accordingly and provide the revised Policies and Procedures to HHS for review and approval. 3. SRMC shall implement the Policies and Procedures within ninety (90) calendar days of HHS’s approval. B. Distribution and Updating of Policies and Procedures 1. SRMC shall distribute such Policies and Procedures to all workforce members at all of its facilities and subsidiaries who use and disclose PHI within sixty (60) calendar days of HHS’s approval of such Policies and Procedures. SRMC shall distribute the Policies and Procedures to any new workforce members who use and disclose PHI within thirty (30) days of their beginning of service. 2. SRMC shall require, at the time of distribution of such Policies and Procedures, a signed written or electronic initial compliance certification from all workforce members who use and disclose PHI stating that the workforce members have read, understands, and shall abide by such Policies and Procedures. 3. SRMC shall assess, update, and revise, as necessary, the Policies and Procedures, at least annually (and more frequently if appropriate). If changes, revisions or updates are required during the term of the Agreement, SRMC shall provide such revised Policies and Procedures to HHS for review and approval. Within 30 days of the effective date of any approved substantive revisions, SRMC shall distribute such revised Policies and Procedures to all workforce members and shall require new compliance certifications.
  • 9. Page 9 4. SRMC shall not involve any workforce member who uses and discloses PHI if that workforce member has not signed or provided the written or electronic certification as required by paragraphs 2 & 3 of this section. C. Minimum Content of the Policies and Procedures The Policies and Procedures shall include, but not be limited to: Safeguards Implementation Specifications (45 C.F.R. §164.530(c)(2)(i)). 1. Instructions and Procedures that address appropriate administrative, technical, and physical safeguards to protect PHI from any intentional or unintentional use or disclosure (a) for media inquiries and (b) that define PHI as it relates to individually identifiable health information (IIHI). 2. Protocols for training all members of SRMC’s workforce who use and disclose PHI to ensure that they know how to comply with the Policies and Procedures provided for in subparagraph (1) above. Uses and Disclosures (45 C.F.R. §164.502(a)) 1. Instructions and Procedures that address permissible and impermissible uses and disclosures of PHI (a) for media inquiries, (b) to workforce members who are not involved in the individual’s medical care and (c) that define PHI as it relates to individually identifiable health information (IIHI). 2. Application of appropriate sanctions against members of SRMC’s workforce who fail to comply with Policies and Procedures provided for in subparagraph (1) above. 3. Protocols for training all members of SRMC’s workforce who use and disclose PHI to ensure that they know how to comply with the Policies and Procedures provided for in subparagraph (1) above. Administrative Requirements Sanctions (45 C.F.R. §164.530(e)). 1. Instructions and Procedures that address (a) What is individually identifiable health information (IIHI) and the protected health information (PHI), including what is required for PHI to be unidentified; (b) Communicating with, and responding to, the media, including in regard to patient-related inquires, and (c) Sharing of patient PHI within SRMC, including sharing of patient PHI with workforce members not involved in the provision of or payment for care. 2. Protocols for training all SRMC’s workforce members who use and disclose PHI to ensure that they know how to comply with the Policies and Procedures provided for in subparagraph (1) above.
  • 10. Page 10 3. Application of appropriate sanctions against SRMC’s workforce members who fail to comply with Policies and Procedures provided for in subparagraph (1) above. D. Reportable Events 1. If SRMC determines that a workforce member has violated these Policies and Procedures required by section V.A.1., SRMC shall notify HHS in writing within thirty (30) days. Such violations shall be known as “Reportable Events.” The report to HHS shall include the following information: a. A complete description of the event, including the relevant facts, the persons involved, and the provision(s) of the Policies and Procedures implicated; and b. A description of SRMC’s actions taken to mitigate any harm and any further steps SRMC plans to take to address the matter and prevent it from recurring. E. Training 1. All workforce members who use or disclose PHI shall receive specific training related to the Policies and Procedures. Within ninety (90) days of the implementation of the Policies and Procedures. SRMC shall provide such training to each new member of the workforce within thirty (30) calendar days of the workforce member’s beginning as a workforce member. 2. Each workforce member who is required to attend training shall certify, in electronic or written form, that he or she received the training. The training certification shall specify the date training was received. All course materials shall be retained in compliance with section VII. 3. SRMC shall review the training at least annually, and, where appropriate, update the training to reflect any changes in Federal law or HHS guidance, any issues discovered during audits or reviews, any other relevant developments. 4. SRMC shall not involve any member of its workforce in the use or disclosure of PHI if that workforce member has not signed or provided the written or electronic training certification as required by paragraph 2 this section. VI. Shasta Regional Medical Center Implementation Report and Annual Report A. Within ninety (90) days after the receipt of HHS’s approval of the Policies and Procedures required by section V.A.1., SRMC shall submit a written report to HHS summarizing the status of its implementation of the requirements of this CAP. This report, known as the “Implementation Report,” shall include:
  • 11. Page 11 1. An attestation signed by SRMC’s authorized representative attesting that the Policies and Procedures have been implemented, have been distributed to all appropriate workforce members and that SRMC has obtained all of the compliance certifications required by section V.B.2. and V.B.3; 2. A copy of all training materials used for the training required by this CAP, a description of the training, including a summary of the topics covered, the length of the session(s) and a schedule of when the training session(s) were held; 3. An attestation signed by SRMC’s authorized representative attesting that all members of the workforce who use or disclose PHI have completed the initial training required by this CAP and have executed the training certifications required by section V.E.2.; and 4. A summary of Reportable Events (defined in section V.D) that have occurred since the Effective Date of this CAP and the status of any corrective and preventative action(s) relating to all such Reportable Events; and 5. An attestation signed by SRMC’s authorized representative stating that he or she has reviewed the Implementation Report, has made a reasonable inquiry regarding its content and believes that, upon such inquiry, the information is accurate and truthful. B. Annual Report. SRMC also shall submit to HHS an Annual Report with respect to the status of and findings regarding SRMC’s compliance with this CAP. SRMC shall submit the Annual Report to HHS no later than nine-months after the Effective Date. The Annual Report shall include: 1. A schedule, topic outline, and copies of the training materials for the training programs attended in accordance with this CAP; 2. An attestation signed by an owner or officer of SRMC attesting that it is obtaining and maintaining written or electronic training certifications from all persons that require training that they received training pursuant to the requirements set forth in this CAP; 3. A summary of Reportable Events (defined in section V.D.) identified and the status of any corrective and preventative action relating to all such Reportable Events; 4. An attestation signed by an owner or officer of SRMC attesting that he or she has reviewed the Annual Report, has made a reasonable inquiry regarding its content and believes that, upon such inquiry, the information is accurate and truthful. //
  • 12. Page 12 VII. Requirement for all facilities listed in Appendix B other than SRMC Affidavit. The CEO and Privacy Officer of each facility listed in Appendix B, excluding Shasta Regional Medical Center, shall submit an affidavit to OCR, through the Compliance Representative, stating that they understand that (a) an individual’s protected health information (“PHI”) is protected by Privacy Rule even if such information is already in the public domain or even though it has been disclosed by the individual; and (b) disclosures of PHI in response to media inquiries are only permissible pursuant to a signed HIPAA authorization. Each facility will ensure that all members of their respective workforce are informed of this policy. The Affidavits shall be submitted to OCR by the Compliance Representative within sixty (60) calendar days of the Effective Date of this Agreement. VIII. Document Retention Covered Entities shall maintain for inspection and copying all documents and records relating to compliance with this CAP for six (6) years. IX. Breach Provisions Covered Entities are expected to fully and timely comply with all provisions contained in this CAP. A. Timely Written Requests for Extensions. Covered Entities may, in advance of any due date set forth in this CAP, submit a timely written request for an extension of time to perform any act required by this CAP. A “timely written request” is defined as a request in writing received by HHS at least five (5) business days prior to the date such an act is required to be performed or any notification or report is due to be filed. B. Notice of Breach and Intent to Impose CMP. The parties agree that a breach of the CAP by SRMC or any of the facilities listed in Appendix B constitutes a breach of the Agreement. Upon a determination by HHS that SRMC or any of the facilities listed in Appendix B has breached this CAP, HHS may notify Covered Entities of: (a) The breach; and (b) HHS’ intent to impose a civil monetary penalty (CMP) pursuant to 45 C.F.R. Part 160 for the Covered Conduct set forth in paragraph 2 of the Agreement and any other conduct that constitutes a violation of the HIPAA Privacy Rule (this notification is hereinafter referred to as the “Notice of Breach and Intent to Impose CMP”). C. Covered Entities’ Response. Covered Entities shall have thirty (30) days from the date of receipt of the Notice of Breach and Intent to Impose CMP to demonstrate to HHS’s satisfaction that 1. Covered Entities are in compliance with the obligations of the CAP cited by HHS as the basis for the breach; or
  • 13. Page 13 2. The alleged breach has been cured; or 3. The alleged breach cannot be cured within the thirty (30) day period, but that (i) Covered Entities have begun to take action to cure the breach; (ii) Covered Entities are pursuing such action with due diligence; and (iii) Covered Entities have provided to HHS a reasonable timetable for curing the breach. D. Imposition of CMP. If, at the conclusion of thirty (30) day period, Covered Entities fail to meet the requirements of section IX C to HHS’s satisfaction, HHS may proceed to impose a CMP pursuant to 45 C.F.R. Part 160 for the Covered Conduct set forth in paragraph 2 of the Agreement and any other conduct that constitutes a violation of the HIPAA Privacy Rule. HHS shall notify Covered Entities in writing of its determination to proceed with the imposition of a CMP. For Covered Entities /s/ 05/31/2013 ________________________________ _____________ Randall Hempling Date Shasta Regional Medical Center /s/ 06/03/2013 ________________________________ ______________ Chris Doan Date Prime Healthcare Management, Inc. For U.S. Department of Health and Human Services /s/ 06/06/2013 ____________________________ _____________ Michael Leoz Date Regional Manager, Region IX DHHS, Office for Civil Rights
  • 14. Page 14 APPENDIX B LIST OF PRIME HEALTHCARE SERVICES FACILITIES CALIFORNIA FACILITIES: Alvarado Hospital Medical Center 6655 Alvarado Road San Diego, CA 92120 Centinela Hospital Medical Center 555 E. Hardy Street Inglewood, CA 90301 Chino Valley Medical Center 5451 Walnut Avenue Chino, CA 91710 Desert Valley Hospital 16850 Bear Valley Road Victorville, CA 92395 Garden Grove Hospital Medical Center 12601 Garden Grove Blvd. Garden Grove, CA 92843 La Palma Intercommunity Hospital 901 Walker Street La Palma, CA 90623 Paradise Valley Hospital 2400 East Fourth Street National City, CA 91950 San Dimas Community Hospital 1350 W. Covina Boulevard San Dimas, CA 91773 Shasta Regional Medical Center 1100 Butte Street Redding, CA 96001 West Anaheim Medical Center 3033 West Orange Avenue Anaheim, CA 92804
  • 15. Page 15 NEVADA FACILTY: Saint Mary's Regional Medical Center 235 West 6th Street Reno, NV 89503 PENNSYLVANIA FACILITIES: Lower Bucks Hospital 501 Bath Road Bristol, PA 19007 Roxborough Memorial Hospital 5800 Ridge Avenue Philadelphia, PA 19128 TEXAS FACILITIES: Dallas Medical Center 7 Medical Parkway Dallas, TX 75234 Harlingen Medical Center 5501 South Expressway 77 Harlingen, TX 78550 Pampa Regional Medical Center One Medical Plaza Pampa, TX 79065