The Center for Children’s Digestive Health (CCDH) recently paid the HHS Office for Civil Rights (OCR) $31,000 and entered into a corrective action plan to settle potential violations of HIPAA for an alleged failure to maintain a business associate agreement with a record storage company (FileFax, Inc.). Following its review of the record storage company, OCR initiated a compliance review of CCDH, which revealed that neither party could produce a signed Business Associate agreement covering the entire period that the storage company maintained records with PHI on behalf of CCDH. The OCR news release is available here, and the resolution agreement and corrective action plan are available here.
