Hospital to pay $150K for lost data, records

Women & Infants Hospital of Rhode Island has agreed to pay $150,000 to resolve allegations that it failed to protect the personal information and protected health information of more than 12,000 patients in Massachusetts, Attorney General Martha Coakley announced.

The consent judgment approved July 22 by Suffolk Superior Court Judge Carol S. Ball resulted from a data breach that included patients’ names, dates of birth, Social Security numbers, dates of exams, physicians’ names, and ultrasound images.

According to the settlement, WIH will pay a $110,000 civil penalty, $25,000 for attorneys’ fees and costs, and a payment of $15,000 to a fund to be used by the AG’s Office to promote education concerning the protection of personal information and protected health information and a fund for future data security litigation.

The hospital discovered in 2012 that it had lost 19 backup tapes from its prenatal diagnostic centers in Providence, Rhode Island, and New Bedford, Massachusetts. They contained ultrasound images and data including names, birth dates and some Social Security numbers.

Under terms of the settlement, the hospital has agreed to audit its data security measures and make improvements. It has taken several steps to prevent such a breach from happening again.