Dive Brief:

• St. Elizabeth's Medical Center in Brighton, MA, has been fined $218,000 for alleged HIPAA violations.
• The settlement was a result of three separate sucurity breaches between 2012 and 2014.
• The most recent breach was attributed to an unsecure file-sharing app. The other two resulted from personal health information (PHI) being stored on a former-employee's computer and failure to shred paper billing records that included patient data.

Dive Insight:

Hospitals that are using file-sharing apps to store PHI may want to re-evaluate their privacy and security policies. "Organizations must pay particular attention to HIPAA's requirements when using Internet-based document sharing applications, "Jocelyn Samuels, Office for Civil Rights (OCR) director, said in a July 10 statement. "In order to reduce potential risks and vulnerabilities, all workforce members must follow all policies and procedures, and entities must ensure that incidents are reported and mitigated in a timely manner."

As of now, the OCR has levied almost $26.4 million for HIPAA privacy, security and breach notification violations. The largest settlement was $4.8 million.