A gastroenterologist in Utah who felt he was being held captive by an electronic health record (EHR) vendor found his 2013 complaint to the HHS Office for Civil Rights (OCR) came back to haunt him. While the payment dispute resolved, OCR took notice of the complaint and turned its attention to Steven Porter, MD, of Ogden. Seven years later, Porter found himself agreeing to pay OCR $100,000 and implement a two-year corrective action plan (CAP) for alleged HIPAA violations.[1]
Porter’s settlement, the first of 2020, comes three months into the new year, and on the heels of 10 OCR enforcement actions in 2019, including one announced with just two days left in the year.[2]
Serena Mosley-Day, OCR senior advisor for HIPAA compliance and enforcement, said at the recent HIPAA Summit that Porter’s settlement is unusual in that it “started as a breach report [but] not the way we traditionally think of it.”