Clinical Laboratory Pays $25,000 to Settle Potential HIPAA Security Rule Violations

Peachstate Health Management, LLC, doing business as AEON Clinical Laboratories (Peachstate), has agreed to pay $25,000 to the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services (HHS) and to implement a corrective action plan to settle potential violations of the Health Insurance Portability and Accountability Act (HIPAA) Security Rule.  Peachstate is based in Georgia and is certified under the Clinical Laboratory Improvement Amendments of 1988 (CLIA).  Peachstate provides diagnostic and laboratory-developed tests, including clinical and genetic testing services.

In December 2017, OCR initiated a compliance review of Peachstate to determine its compliance with the HIPAA Privacy and Security Rules.  OCR’s investigation found systemic noncompliance with the HIPAA Security Rule, including failures to conduct an enterprise-wide risk analysis, implement risk management and audit controls, and maintain documentation of HIPAA Security Rule policies and procedures.

“Clinical laboratories, like other covered health care providers, must comply with the HIPAA Security Rule.  The failure to implement basic Security Rule requirements makes HIPAA regulated entities attractive targets for malicious activity, and needlessly risks patients’ electronic health information,” said Robinsue Frohboese, Acting OCR Director. “This settlement reiterates OCR’s commitment to ensuring compliance with rules that protect the privacy and security of protected health information.”   

In addition to the monetary settlement, Peachstate has agreed to a robust corrective action plan that includes three years of monitoring.  The resolution agreement and corrective action plan may be found at: https://www.hhs.gov/sites/default/files/peachstate-ra-cap.pdf*.

*People using assistive technology may not be able to fully access information in this file. For assistance, contact OCR at (800) 368-1019, TDD toll-free: (800) 537-7697, or by emailing [email protected].