[Answered]: UCLA Health System Link: HHS-OCR Resolution…

UCLA Health System Link: HHS-OCR Resolution Agreement – UCLA Health System Details of the Case From approximately 2005 through 2008, employees of the UCLA Health System (a hospital system under the University of California at Los Angeles Health System) repeatedly viewed the electronic Protected Health Information (ePHI) of two celebrity patients, as well as several other patients, for impermissible reasons. The initial complaints were submitted by two celebrity patients. OCR’s investigation revealed that in addition to the impermissible access, the UCLA Health System did not adequately limit access, did not sanction the offending employees, did not provide meaningful workforce training on the Privacy Rule and Security Rule, and did not have auditing and monitoring in place to detect the impermissible access. The complaint was both a privacy rule violation (impermissible access) and a security rule aspect (lack of adequate controls and training) issue. Penalty US $865,500 – The UCLA Health System paid this amount as part of the settlement. There was also a corrective action plan (CAP) involved with three-year monitoring.