Full Answer
Who is the CR of CHSPSC?
The CR shall be an individual who is knowledgeable about the HIPAA Rules and about the policies and practices of CHSPSC with respect to ePHI. The CR shall be responsible for assuring CHSPSC’s compliance with this Agreement and the CAP and for arranging for the provision of such assistance as CHSPSC may require to comply with the Agreement and the CAP, including, but not limited to, arranging for and/or providing policies, procedures, training and internal monitoring services.
How much does CHSPSC pay HHS?
Payment. CHSPSC has agreed to pay HHS the amount of $2,300,000 (“Resolution Amount”). CHSPSC agrees to pay the Resolution Amount on the Effective Date of this Agreement as defined in Section II.9 pursuant to written instructions to be provided by
How long does CHSPSC maintain records?
CHSPSC shall maintain for inspection and copying, and shall provide to OCR upon request, all documents and records relating to compliance with this CAP for six (6) years from the Effective Date.
How long does it take for a CHSPSC to submit training materials to HHS?
Within two-hundred ten (210) days of the Effective Date, CHSPSC shall submit its proposed training materials to HHS for its review and approval, along with the policies and procedures required by Section V.C. of this CAP.
What was the APT18 attack?
On April 10, 2014, an Advanced Persistent Threat group , known as APT18, compromised administrative credentials and remotely accessed CHSPSC’s information system through its virtual private network (VPN). CHSPSC was unaware of the intrusion until notified by the Federal Bureau of Investigation (FBI) on April 18, 2014. The last identified evidence of attacker activity occurred on August 18, 2014. It was determined that APT18’s intrusion affected 237 covered entities served by CHSPSC and that APT18 exfiltrated the PHI of 6,121,158 individuals, including name, sex, date of birth, phone number, social security number, email, ethnicity, and emergency contact information. HHS’s investigation indicated potential violations of the following provisions (“Covered Conduct”):
