Idaho State University will pay $400,000 to settle allegations that it violated the Health Insurance Portability and Accountability Act, the federal law, known as Hipaa, that governs the privacy of medical records, the U.S. Department of Health and Human Services’ Office for Civil Rights announced on Tuesday.
The office said the settlement concerned a breach of health records belonging to roughly 17,500 patients at the university’s family-medicine clinic in Pocatello, Idaho. The university notified the department of the breach, in which patients’ records were made vulnerable to exposure for at least 10 months because firewall protections on the university’s servers had been disabled.
An investigation by the federal office found that the university’s risk assessments were incomplete. The office said Idaho State had agreed to correct the problems identified in its investigation. An Idaho State compliance officer told the Associated Press that the institution had found that none of the records made vulnerable were actually compromised.



