Lack of Business Associate Agreement Costs Illinois Health System $31,000

​A small, for-profit healthcare system in Illinois has agreed to pay the U.S. Department of Health and Human Services (HHS) $31,000 and implement a corrective action plan to settle potential violations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) privacy rules. HHS' Office for Civil Rights (OCR) began a compliance review of the system in August 2015, after an investigation of a business associate, which stored records that contained protected health information (PHI) for the health system.