CASE STUDY

Clearwater Saves Anchorage Community Mental Health Services, Inc. $3M in OCR Fines

Project Overview

Anchorage Community Mental Health Services, Inc. (ACMHS) has been the largest community mental health provider in the state of Alaska since 1974. ACMH’S mission is to promote recovery and wellness by providing consumer-driven behavioral health care services to the people of Anchorage and surrounding areas.

Challenges

An OCR investigation following a breach of unsecured electronic protected health information (ePHI) resulted in a corrective action plan and over $3 million in fines.
Establishing a HIPAA information risk management program in response to the investigation included:
- Conducting an accurate and thorough assessment of the risks and vulnerabilities threatening the security of ePHI.
- Implementing mandated policies and procedures, as well as technical security measures to guard against unauthorized access to ePHI

Solutions

Utilized Clearwater’s IRM|AnalysisTM software to conduct a bona fide
HIPAA security risk analysis.
Met the explicit requirement for a risk analysis within the Security
Management Process Standard [45 CFR 164.308(a)(1)] of the HIPAA
Security Final Rule.
Generated reports from IRM|AnalysisTM for submission to the Health and
Human Office for Civil Rights to demonstrate evidence of a bona fide risk
analysis.

Outcomes

Completed a rigorous security self-assessment vis-à-vis HIPAA Security Rule, establishing a baseline / benchmark score and populating the software tool with a current-state Risk status that will enable ongoing risk management.
Implemented required policies and procedures, and administrative and technical security measures.
Achieved a 100% score on OCR post-investigation audit.
Reduced OCR fine from $3.3M to $150,000!
Ongoing solutions from Clearwater will be essential in keeping the fine in abeyance during the 2 year Compliance Agreement with OCR.

Download Case Study

The Clearwater Compliance website has been a critical source of information for my HIPAA compliance efforts over many years. The information format is easy to read and understand, and it gets to the point. Clearwater Compliance obviously cares about helping us keep out of trouble!

Tim Moser

Shawnee Township Fire Department

We choose Clearwater because they are a front runner in consulting and assisting with this area. And, they also have developed Risk Analysis software to help you meet the Meaningful Use criteria and qualify for incentives. They may be listed as a consulting group, but they will also train and adjust to whatever is needed based upon your in-house expertise.

Wayne Richmond

Princeton Community Hospital

Products & Services Employed

IRM|Analysis™

Clearwater’s HIPAA Risk Analysis Software

Would you fare well in an OCR audit or investigation? Are you struggling to find guidance, tools, and methodology to conduct your security risk analysis?

IRM|Analysis™ provides an approach and methodology to help your organization to meet HIPAA and Meaningful Use requirements. It strictly follows the HHS/OCR guidance given for Security Risk Analysis and harnesses the power of the NIST risk assessment processes.

Tim Moser

Shawnee Township Fire Department

Wayne Richmond

Princeton Community Hospital

About Clearwater

Clearwater provides the most complete and trusted, enterprise-class cyber risk management solution available. Designed for healthcare providers and their partners, Clearwater’s IRM|Pro® platform and experienced professional services team provide insights and actions to address compliance, cyber and patient safety risks. Clearwater is a 2017 Inc. 5000 fastest-growing company, the 2018 Best in KLAS winner in Cybersecurity Advisory Services, the 2017, 2018, and 2019 Black Book Marketing Research winner in Compliance and Risk Management Solutions, and exclusively endorsed by numerous state hospital associations. Clearwater solutions have been deployed within hundreds of hospitals and health systems, Fortune 100 organizations, and federal government institutions.