Aetna Fined $1 million for three 2017 breaches that occurred within six months. The Department of Health and Human Services’ Office for Civil Rights says its investigation into the three incidents involving impermissible data disclosures revealed a number of HIPAA deficiencies. Those deficiencies included failing to:Perform periodic evaluations of operational changes affecting the security of electronic protected health information;.Implement procedures to verify the identity of people or entities seeking access to ePHI;.Limit PHI disclosures to the minimum necessary to accomplish the purpose of the use or disclosure;. Have in place appropriate administrative, technical and physical safeguards to protect the privacy of PHI.”]
Source: https://www.inforisktoday.com/aetna-fined-1-million-after-3-data-breaches-a-15264