Close X

Attorney General Becerra Announces $2 Million Settlement Involving Santa Barbara-based Cottage Health System Over Failure to Protect Patient Medical Records

Posted by Fay Arfa | Nov 24, 2017 | 0 Comments

SANTA BARBARA — California Attorney General Xavier Becerra today announced a $2 million settlement with Cottage Health System and its affiliated hospitals in California resolving allegations that they failed to implement basic, reasonable safeguards to protect patient medical information in violation of state and federal privacy laws. The settlement requires Cottage to maintain security practices and procedures to protect patients' medical information from unauthorized access or disclosure. This settlement follows two separate data breach incidents by Cottage Health where more than 50,000 patients' medical information was made publicly available online.

“When patients go to a hospital to seek medical care, the last thing they should have to worry about is having their personal medical information exposed. The law requires health care providers to protect patients' privacy. On both of these counts, Cottage Health failed,” said Attorney General Becerra.

In this action, the Attorney General's Office alleged that Cottage Health System, a not-for-profit based in Santa Barbara, California, failed to adequately protect patient records. Cottage was notified in December 2013 that patients' confidential medical information was viewable online. One of the company's servers with medical records for more than 50,000 patients was connected to the internet without encryption, password protection, firewalls, or permissions that would have prevented unauthorized access. In 2015, during the Attorney General's investigation of the first breach, Cottage Health experienced a second data breach in which the records for 4,596 patients became accessible online for nearly two weeks. The Attorney General's Office alleged that Cottage's security failures violated California's Confidentiality of Medical Information Act and Unfair Competition Law, as well as the federal Health Insurance Portability and Affordability Act.

Under the settlement announced today, Cottage Health is required to pay a $2 million penalty and upgrade its data security practices. Cottage Health is required to protect patients' medical information from unauthorized access and disclosure and to maintain an information security program that meets reasonable security practices and procedures for the healthcare industry. It must designate an employee to serve in the capacity of a Chief Privacy Officer and to complete periodic risk assessments.

Attorney General Becerra is committed to protecting consumer and individual privacy through civil prosecution of state and federal privacy laws.

A copy of the complaint and the stipulated judgment containing the terms of the settlement, which remains subject to court approval, are attached to the electronic version of this release at https://oag.ca.gov/media/news.

Medical information for more than 50,000 patients was made public due to the lack of reasonable safeguards

Attorney General Xavier Becerra / Wednesday, November 22, 2017

About the Author

Fay Arfa

Fay Arfa has the distinction of being Certified as a Specialist in two separate areas of law – Criminal Law as well as Appellate Law – by the California State Bar, Board of Specialization. The National Board of Trial Advocacy has also awarded her a board Certification in Criminal Trial Advocacy. ...

Comments

There are no comments for this post. Be the first and Add your Comment below.

Leave a Comment

Board Certifications



Contact Us Today

Fay Arfa is committed to answering your questions about Trials, Appeals, Habeas Corpus, State Crimes, Federal Crimes, and Sex Crimes law issues in California.

We offer a free telephone consultation and we'll gladly discuss your case with you at your convenience. Contact us today to schedule an appointment.