M.D. Anderson’s $4.3 Million Fine for Patient Data Loss Vacated

The University of Texas’s M.D. Anderson Cancer Center dodged a $4.3 million fine for losing over 35,000 people’s protected health information after the Fifth Circuit ruled Thursday that HHS acted arbitrarily and capriciously in finding that the provider violated two information security regulations.

The U.S. Health and Human Services Department incorrectly applied regulations implementing the Health Insurance Portability and Accountability Act and the the Health Information Technology for Economic and Clinical Health Act to impose civil monetary penalties far in excess of a statutorily mandated $100,000 yearly cap, the U.S. Court of Appeals for the Fifth Circuit said.

M.D. ...