Skip to main content


U.S. flag
      An official website of the United States government
              Here’s how you know
        Here’s how you knowDot gov**Official websites use .gov**
                 A **.gov** website belongs to an official government organization in the United States.
                  HTTPS**Secure .gov websites use HTTPS**
                 A **lock** (A locked padlock) or **https://** means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites. 
  Menu Close
          HHS Search (hipaa)
    Search
        








  
  
    

  
      

                                      About HHS
    
                        
                              
      
      
      Programs & Services
    
                        
                              
      
      
      Grants & Contracts
    
                        
                              
      
      
      Laws & Regulations                  
Health Information Privacy
  HIPAA for Individuals
    
                        
                                            
      
      
      Filing a Complaint
    
                        
                                            
      
      
      HIPAA for Professionals
    
                        
                                            
      
      
      Newsroom

              

    



Breadcrumb
    HHS
                              HIPAA Home
                              For Professionals
                              HIPAA Compliance and Enforcement
                              Case Examples
                              Resolution Agreement


    

    

    Navigate to:
  HIPAA for Professionals
    
                                    
                                            
            
      
      
      
      Regulatory Initiatives
    
                                                  
                                                                  
            
      
      
      
      Privacy
                                            
            
            Summary of the Privacy Rule
    
                                                  
                                            
            
      
      
      
      Guidance
    
                                                  
                                            
            
      
      
      
      Combined Text of All Rules
    
                                                  
                                            
            
      
      
      
      HIPAA Related Links
    
                                                  
                                                                  
            
      
      
      
      Security
                                            
            
            Summary of the Security Rule
    
                                                  
                                            
            
      
      
      
      Security Guidance
    
                                                  
                                            
            
      
      
      
      Cyber Security Guidance
    
                                                  
                                                                  
            
      
      
      
      Breach Notification
                                            
            
            Breach Reporting
    
                                                  
                                            
            
      
      
      
      Guidance
    
                                                  
                                            
            
      
      
      
      Reports to Congress
    
                                                  
                                            
            
      
      
      
      Regulation History
    
                                                  
                                                                  
            
      
      
      
      Compliance & Enforcement
                                            
            
            Enforcement Rule
    
                                                  
                                            
            
      
      
      
      Enforcement Process
    
                                                  
                                            
            
      
      
      
      Enforcement Data
    
                                                  
                                            
            
      
      
      
      Resolution Agreements
    
                                                  
                                            
            
      
      
      
      Case Examples
    
                                                  
                                            
            
      
      
      
      Audit
    
                                                  
                                            
            
      
      
      
      Reports to Congress
    
                                                  
                                            
            
      
      
      
      State Attorneys General
    
                                                  
                                                                  
            
      
      
      
      Special Topics
                                            
            
            HIPAA and Part 2
    
                                                  
                                            
            
      
      
      
      Change Healthcare Cybersecurity Incident FAQs
    
                                                  
                                            
            
      
      
      
      HIPAA and COVID-19
    
                                                                
                                                                  
            
      
      
      
      HIPAA and Reproductive Health
                          
            
            HIPAA and Final Rule Notice
    
                                                  
                                            
            
      
      
      
      HIPAA and Telehealth
    
                                                  
                                            
            
      
      
      
      HIPAA and FERPA
    
                                                  
                                            
            
      
      
      
      Research
    
                                                  
                                            
            
      
      
      
      Public Health
    
                                                  
                                            
            
      
      
      
      Emergency Response
    
                                                  
                                            
            
      
      
      
      Health Information Technology
    
                                                  
                                            
            
      
      
      
      Health Apps
    
                                                  
                                                                  
            
      
      
      
      Patient Safety
                                            
            
            Statute & Rule
                          
            
            PSQIA Statute
    
                                                  
                                            
            
      
      
      
      Patient Safety Rule
    
                                                  
                                            
            
      
      
      
      Enforcement
    
                                                  
                                            
            
      
      
      
      Guidance
    
                                                  
                                                                  
            
      
      
      
      Covered Entities & Business Associates
                                            
            
            Business Associate Contracts
    
                                                  
                                            
            
      
      
      
      Business Associates
    
                                    
                                            
            
      
      
      
      Training & Resources
    
                                    
                                            
            
      
      
      
      FAQs for Professionals
    
                                    
                                            
            
      
      
      
      Other Administrative Simplification RulesText resize icon

                    




Resolution Agreement








  
  
    

  
      





HHS, Providence Health & Services Agree on Corrective Action Plan to Protect Health Information

On July 16, 2008, the U.S. Department of Health & Human Services (HHS) entered into a Resolution Agreement with Seattle-based Providence Health & Services (Providence) to settle potential violations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy and Security Rules.

In the agreement, Providence agrees to pay $100,000 and implement a detailed Corrective Action Plan to ensure that it will appropriately safeguard identifiable electronic patient information against theft or loss. The Resolution Agreement relates to Providence's loss of electronic backup media and laptop computers containing individually identifiable health information in 2005 and 2006.

A Resolution Agreement is a contract signed by HHS and a covered entity in which the covered entity agrees to perform certain obligations (e.g., staff training) and make reports to HHS for a period of years, typically three years. During the period, HHS monitors the compliance of the covered entity with the obligations it has agreed to perform.

With respect to the HIPAA Privacy and Security Rules, this is the first time HHS has required a Resolution Agreement from a covered entity. Providence's cooperation with OCR and CMS allowed HHS to resolve this case without the need to impose a civil money penalty.

The incidents giving rise to the agreement involved two entities within the Providence health system, Providence Home and Community Services and Providence Hospice and Home Care. On several occasions between September 2005 and March 2006, backup tapes, optical disks, and laptops, all containing unencrypted electronic protected health information, were removed from the Providence premises and were left unattended. The media and laptops were subsequently lost or stolen, compromising the protected health information of over 386,000 patients. HHS received over 30 complaints about the stolen tapes and disks, submitted after Providence, pursuant to state notification laws, alerted patients to the theft. Providence also reported the stolen media to HHS. OCR and CMS together focused their investigations on Providence's failure to implement policies and procedures to safeguard this information.

As a result, Providence agrees to pay a $100,000 resolution amount to HHS and implement a robust Corrective Action Plan that requires: revising its policies and procedures regarding physical and technical safeguards (e.g., encryption) governing off-site transport and storage of electronic media containing patient information, subject to HHS approval; training workforce members on the safeguards; conducting audits and site visits of facilities; and submitting compliance reports to HHS for a period of three years.

Back to Top

Additional information

Read the Resolution Agreement
	Read the Press Release

                    
  


Content created by Office for Civil Rights (OCR) Content last reviewed December 23, 2022Back to top
    Contact HHS
    
                        
                                            
      
      
      Careers
    
                        
                                            
      
      
      HHS FAQs
    
                        
                                            
      
      
      Nondiscrimination NoticeHHS Archive
    
                        
                                            
      
      
      Accessibility Statement
    
                        
                                            
      
      
      Privacy Policy
    
                        
                                            
      
      
      Viewers & PlayersBudget/Performance
    
                        
                                            
      
      
      Inspector General
    
                        
                                            
      
      
      Web Site Disclaimers
    
                        
                                            
      
      
      EEO/No Fear ActFOIA
    
                        
                                            
      
      
      The White House
    
                        
                                            
      
      
      USA.gov
    
                        
                                            
      
      
      Vulnerability Disclosure Policy
        Sign Up for Email Updates

Receive the latest updates from the Secretary, Blogs, and News Releases.

Sign Up
  HHS Headquarters
          200 Independence Avenue, S.W.
                  Washington, D.C. 20201
                  Toll Free Call Center: 1-877-696-6775​Disclaimer Policy: Links with this icon () mean that you are leaving the HHS website.
              The Department of Health and Human Services (HHS) cannot guarantee the accuracy of a non-federal website.
                  Linking to a non-federal website does not mean that HHS or its employees endorse the sponsors, information, or products presented on the website. HHS links outside of itself to provide you with further information.
                  You will be bound by the destination website's privacy policy and/or terms of service when you follow the link.
                  HHS is not responsible for Section 508 compliance (accessibility) on private websites.For more information on HHS's web notification policies, see Website Disclaimers.
              Continue
                  Go back