WellPoint To Pay $1.7 Million HIPAA Penalty For Patient Privacy Violations

On July 8, 2013, Indiana-based managed care company WellPoint Inc. agreed to pay a $1.7 million penalty to the U.S. Department of Health and Human Services (HHS) to settle potential violations of the Health Insurance and Portability and Accountability Act of 1996 (HIPAA) Privacy and Protection Security Rule. The HHS Office of Civil Rights (OCR) alleged that security weaknesses in an online application database left the electronic protected health information (ePHI) of 612,402 individuals served by WellPoint accessible to unauthorized individuals over the Internet. On September 9, 2010, the OCR began an investigation of WellPoint following . . .