By Mark Young and Tom Jackson

On February 20, 2015, the Information Commissioner’s Office (“ICO”) fined Staysure.co.uk Ltd (“Staysure”), an online travel insurer, £175,000 for failing to protect its customers’ personal data.  In addition to technical vulnerabilities, the ICO took into account Staysure’s lack of security policies and practices when levying the fine.

In short, Staysure had failed to implement processes to ensure that key software updates were applied, leading to vulnerabilities in the company’s IT systems.  As a result, hackers gained access to customers’ personal details, medical data, and payment card information, including over 100,000 sets of credit card details relating to more than 90,000 individual customers.  These stolen details were then used in relation to more than 5,000 fraudulent transactions.
Continue Reading ICO Fines Insurance Company £175k for Data Security Breach, Criticising Lack of Policies

The Office for Civil Rights (OCR) within the Department of Health and Human Services (HHS) announced Tuesday that it has issued a Notice of Final Determination finding that Cignet Health of Prince George’s County, Maryland (Cignet) violated the HIPAA Privacy Rule.  HHS imposed a $4.3 million civil money penalty on Cignet for the violations—the first civil money penalty ever issued by HHS for violations of the Privacy Rule.

The civil money penalty imposed on Cignet is based on the new violation categories and increased penalty amounts established under the HITECH Act, which we reported on previously.  In a Notice of Proposed Determination issued on October 20, 2010, OCR found that:

  • Between September 2009 and October 2009, Cignet failed to provide 41 individuals with timely access to copies of protected health information (PHI) about them in the designated record sets maintained by Cignet, in violation of 45 C.F.R. § 164.524.
  • From March 2009 through April 2010, Cignet failed to cooperate with OCR’s investigation of 27 complaints regarding Cignet’s noncompliance described above, in violation of 45 C.F.R. § 160.310(b).


Continue Reading HHS Imposes $4.3 Million Civil Money Penalty for HIPAA Privacy Violations