Pagosa Springs Medical Center (PSMC) has agreed to pay $111,400 to the Office for Civil Rights (OCR) to settle HIPAA violations.
PSMC is a critical access hospital, that provides more than 17,000 hospital and clinic visits annually and employs more than 175 individuals. The latest settlement, discloses that the Colorado hospital failed to terminate former employee’s access to electronic protected health information (PHI)
After receiving a complaint that a former PSMC employee had remote access to the organization’s web-based scheduling calendar, which contained patient PHI, OCR determined that PSMC improperly disclosed the ePHI of 557 patients to this former employee, and did not have a business associates agreement in place with the scheduling calendar vendor.
Under the latest settlement, PSMC has agreed to pay $111,400 and follow a two-year corrective action plan for updating it’s security management, business associates agreements (BAA), administrative policies, and workforce training. OCR Director Roger Severino stressed the this settlement’s significance for covered entities and PHI access:
“It’s common sense that former employees should immediately lose access to protected patient information upon their separation from employment,” said OCR Director Roger Severino. “This case underscores the need for covered entities to always be aware of who has access to their ePHI and who doesn’t.”
Covered entities that do not have or follow procedures to terminate information access privileges upon employee separation risk a HIPAA enforcement action. Covered entities must also evaluate relationships with vendors to ensure that business associate agreements are in place with all business associates before disclosing protected health information.
What Does This Violation Mean?
This settlement with PSMC emphasizes OCR’s enforcement of HIPAA’s Access Control and Person or Entity Authentication requirements. Organization’s must have unique user credentials for each user that interacts with PHI. Additionally, organizations should follow the principal of least privilege – User access should be disabled when PHI access is no longer necessary (IE. An employee leaving, staff not needing patient access, etc). Administrative policies should be in place for managing access control, employee access, and vendors. Business Associates Agreements (BAA) must be signed with all 3rd party vendors that handle protected health information (PHI).
How Can Dash Help?
Unlike many solutions which address either technical controls or administrative controls, Dash empowers users to customize and create policies then enforce those policies via continuous compliance monitoring. For this specific violation, the Dash Employees Policy will cover specifics on how to address access controls for terminated or former employees and contractors. By connecting this policy to IAM role related monitoring and the System Access Policy, Dash users can prevent this exact issue in a customized and proactive manner.
FAQ: Lessons from the Pagosa Springs Medical Center Settlement
What is a HIPAA corrective action plan?
A corrective action plan is a set of required remediation steps an organization agrees to complete under OCR supervision, usually for a defined period. It typically obligates the entity to revise policies, retrain workforce members, submit progress reports, and undergo monitoring. In this settlement the plan runs for two years and covers security management, business associate agreements, administrative policies, and workforce training.
How quickly must access be revoked when an employee leaves?
HIPAA does not specify a number of hours, but the requirement is that access is terminated when it is no longer necessary for the workforce member’s role. OCR’s position in this case was that a separated employee should lose access immediately upon departure. Operationally, that means offboarding is triggered by the HR termination event, not by a later cleanup pass, and the revocation is documented with a timestamp.
Does this apply to contractors and temporary staff?
Yes. The access control and person-or-entity authentication standards apply to all workforce members, which HIPAA defines to include employees, volunteers, trainees, and contractors whose conduct is under the entity’s direct control. Contractor and vendor accounts are a common gap because they are often created outside the standard HR onboarding flow and therefore missed by HR-driven offboarding.
What evidence should we keep to prove access was terminated?
Keep the termination ticket or HR record, the identity of the accounts disabled, the timestamp of each revocation, and confirmation that sessions and refresh tokens were invalidated rather than only the password being changed. For cloud environments, retain the identity provider or IAM audit log entries showing the disable action and any subsequent access attempts. This is the evidence an investigator or auditor will ask for first.
Why was a business associate agreement relevant to a scheduling calendar?
A web-based scheduling calendar that stores patient names, appointment details, or other identifiers is handling ePHI on the covered entity’s behalf, which makes the vendor a business associate. A BAA must be in place before PHI is disclosed to that vendor. The absence of an agreement was a separate violation from the access control failure, which is why both appeared in the same resolution.
Can we sign a BAA retroactively to fix a missing agreement?
A BAA signed after the fact does not erase the period during which PHI was disclosed without one. You can and should execute an agreement to stop the ongoing exposure, but treat the earlier gap as a reportable compliance issue, document the affected dates and data, and assess whether breach notification analysis is required.
How do we find accounts that were never deprovisioned?
Run a periodic reconciliation between your authoritative workforce roster and the identities that actually hold access, rather than relying on the offboarding process alone. Flag accounts with no matching active worker, dormant accounts with no recent authentication, and accounts still holding privileged roles after a role change. Automating this check on a recurring schedule is what turns it from an annual cleanup into a control.
Does unique user identification prohibit shared accounts?
The Security Rule requires unique user identification for anyone who accesses ePHI, so shared logins are not acceptable for systems containing PHI. Where a shared account is unavoidable for a technical function, it should be a non-human service identity with tightly scoped permissions, no interactive login, and credentials managed in a secrets store rather than shared among staff.
What are the HIPAA penalty tiers for a violation like this?
Civil money penalties are tiered by culpability, ranging from a lack of awareness through reasonable cause, willful neglect that was corrected, and willful neglect that was not corrected, with each tier carrying a different annual cap. The settlement amount reflects the facts of the case and the entity’s cooperation, so it is not a predictable formula you can budget against.
How does this case map to SOC 2 controls?
The same failure maps to the logical access criteria covering registration and deprovisioning of users, authorization of access rights, and removal of access when employment ends. Organizations pursuing both frameworks can evidence one offboarding control against HIPAA access control requirements and the SOC 2 logical access criteria, which is why a single monitored control set is more efficient than parallel programs.
