U.S. Department of Health and Human Services Office for Civil Rights (OCR) recently announced yet another enforcement action. Specifically, OCR opened a compliance review of Concentra Health Services (Concentra) upon receiving a report that an unencrypted laptop was stolen from the Springfield Missouri Physical Therapy Center. The investigation revealed that Concentra had previously recognized in multiple risk analyses that critical risks existed. While steps were taken to address the risks, OCR found the efforts to be incomplete and inconsistent. OCR’s investigation further found insufficient security management processes to safeguard patient information. Concentra has agreed to pay OCR $1,725,220 to settle potential violations and will adopt a corrective action plan to evidence their remediation of these findings.
