Idaho State University fined for breach

BOISE – Idaho State University is paying $400,000 to the federal government to settle allegations it improperly exposed confidential medical records.

In August 2011, ISU told the U.S. Department of Health and Human Services of a breach of its unsecured electronically protected health information.

An investigation by the federal agency determined the Pocatello school hadn’t adequately assessed potential risks to medical information shielded from release by the law known as the Health Insurance Portability and Accountability Act, or HIPAA.

Greg Ehardt, ISU’s new HIPAA officer, said none of the 17,500 records that were vulnerable were compromised.