Privacy & Information Security Law Blog

On December 3, 2024, the U.S. Department of Health and Human Services (“HHS”) Office for Civil Rights (“OCR”) announced it imposed a $1.19 million civil monetary penalty on Gulf Coast Pain Consultants, LLC d/b/a Clearway Pain Solutions Institute (“Gulf Coast Pain Consultants”) for various HIPAA Security Rule violations, including a failure to terminate former workforce members’ access to systems containing electronic protected health information (“ePHI”). Gulf Coast Pain Consultants is a Florida-based pain management practice with locations in other states, including Alabama, Delaware, Maryland, New Jersey and Pennsylvania.

OCR’s investigation began after it received a breach notification from Gulf Coast Pain Consultants, in which the company reported that its electronic medical record systems were accessed without authorization by a former contractor on three occasions. The former contractor accessed the ePHI of approximately 34,310 individuals, including their Social Security numbers, chart numbers, and insurance and primary care information. Shortly after Gulf Coast Pain Consultants learned about the unauthorized access to its systems, it shut out the former contractor and filed a breach notification with the OCR.

OCR’s investigation found four violations of the HIPAA Security Rule by Gulf Coast Pain Consultants, including failures to:

• conduct an accurate and thorough risk analysis to determine the potential risks and vulnerabilities to ePHI in its systems;
• implement procedures to regularly review records of activity in information systems;
• implement procedures to terminate former workforce members’ access to ePHI; and
• implement procedures for establishing and modifying workforce members’ access to information systems.

Following the conclusion of OCR’s investigation, the agency issued a Notice of Proposed Determination announcing its intention to impose a civil monetary penalty. Gulf Coast Pain Consultants waived its right to a hearing and did not contest OCR’s findings. As a result, OCR imposed a civil monetary penalty of $1,190,000.