In the ruling, the Judge found that The University of Texas MD Anderson Cancer Center (MD Anderson) violated the HIPAA RULE for Privacy and Security Rules and granted summary judgment to the Office for Civil Rights (OCR) on all issues, requiring MD Anderson to pay $4,348,000 in civil money penalties to OCR. The $4.3 million dollar fine is the fourth largest amount ever awarded to OCR.
MD Anderson is an academic institution and a comprehensive cancer treatment and research center located at the Texas Medical Center in Houston. OCR investigated MD Anderson following three separate data breach reports in 2012 and 2013 involving the theft of an unencrypted laptop from the residence of an MD Anderson employee and the loss of two unencrypted universal serial bus (USB) thumb drives containing the unencrypted electronic protected health information (ePHI) of over 33,500 individuals.
OCR’s investigation found that MD Anderson had written encryption policies going as far back as 2006 and that MD Anderson’s own risk analyses had found that the lack of device-level encryption posed a high risk to the security of ePHI. Despite the encryption policies and high risk findings, MD Anderson did not begin to adopt an enterprise-wide solution to implement encryption of ePHI until 2011, and even then it failed to encrypt its inventory of electronic devices containing ePHI between March 24, 2011 and January 25, 2013.
“OCR is serious about protecting health information privacy and will pursue litigation, if necessary, to hold entities responsible for HIPAA violations,” said OCR Director Roger Severino. “We are pleased that the judge upheld our imposition of penalties because it underscores the risks entities take if they fail to implement effective safeguards, such as
data encryption, when required to protect sensitive patient information.”
LESSONS LEARNED 1. MD Anderson had written encryption politics going back to 2006, and had identified lack of
encryption as a material weakness in their own risk analysis!
2. If a HIPAA Risk Analysis identifies a weakness in a critical area like encryption, immediately
start encrypting all electronic devices.
We provide the best CMS Facility All-Hazards Risk Assessments, HIPAA Risk Analysis, as well as Active Shooter Training,
Workplace Violence Assessments, and Mass Casualty Drills & Training Programs.
According to a retired Secret Service agent, Parkland’s Marjorie Stoneman Douglass staff was well
aware of the lack of security as much as 60 days before the fatal shooting took place. The former agent, Steve Wexler,
was invited to review the high school for security and he reported numerous weaknesses to the MSD staff including:
“Gates were unlocked. Students did not wear identification badges. A fire alarm could send students streaming into the halls. Active-shooter drills were inadequate,” he said.
In addition, he noted, “This stuff is blatantly obvious. You’ve got to fix this,’” Wexler said. He never
heard from the school again. His recommendations included:
1. School gates should be locked, and students should wear ID badges showing they belong on campus.
The shooter on Feb. 14 was able to get on campus because the gates were opened at the end of the school day.
Active-shooter drills should be routine. After the shooting, some students said they had not been involved
in drills this year.
Any adult should be able to declare a Code Red to lock down the school. Clark, the school district spokeswoman, said that is the current protocol, but Wexler said he was told an assistant principal notifies the principal, who then makes the call. “That’s a problem,” he said he told the staff. “This stuff happens fast. This playing telephone is no good. By that time we could sit down and have breakfast.”
Schools should not immediately evacuate students for a fire alarm without first confirming there’s a fire. During the shooting, the gunfire set off the smoke alarm, and students fled into the halls, where the shooter could take aim.
LESSONS LEARNED 1. If you have a security iny weaknesses identified by an expert – TAKE THEIR ADVICE AND
fix the issues that were identified!
2.
Liability increases if staff were clearly warned BEFORE an incident that there were
existing security weaknesses.
We provide the best Active Shooter Training, School Security Assessments, and & CMS Facility All-
Hazards Risk Assessments, Drills & Training Programs.
In a memo sent to top staff earlier in the week, “CMS identified a serious risk of harm to patients due to ligature risks
from the fire system in patient care areas of Building 21 ,” said the memo, which was obtained by public radio. Building 21 is where civil, or non-criminal, patients are treated on five different wards. Typically a ward has 30 patients. Western State Hospital is a Psychiatric Residential Treatment Center (PRTC) with over 800 beds.
A CMS finding of serious risk of harm is also known as an “immediate jeopardy.” The memo also said that if the issue is not resolved, funding could be lost in 23 days.
Since 2015, Western State Hospital has been under scrutiny for serious repeat violations that inspectors said put patients and staff at risk. The litany of troubles included violent assaults on patients and staff, the 2016 escape of two high-risk patients and scores of unauthorized patient “walkaways.”
The safety violations were discovered by a team of 22 federal surveyors who were re-inspecting the hospital last week as part of a turnaround plan that is approaching the two-year mark. The sprawling hospital, which serves civil and forensic patients, must meet standards on 26 federal “Conditions of Participation” in order to continue receiving federal funding.
A “root cause” report in 2016 identified ineffective management, staff reductions and turnover leading to patients who felt “neglected” and a “culture of helplessness” among staff. A review by the Department of Corrections also found numerous security gaps including 25,000 master keys unaccounted for.
LESSONS LEARNED
1. CMS requires all residential treatment facilities to maintain a safe physical environment, and any
identified risk situations should be addressed immediately to prevent loss of CMS reimbursement funds..
We provide the best Active Shooter Training, Workplace Violence Assessments, and & CMS Facility All-
Hazards Risk Assessments, Drills & Training Programs.
SEVENTEEN-YEAR-OLD ACTIVE SHOOTER AT SANTA FE, TEXAS HIGH SCHOOL KILLS 10,
INJURES 13, AFTER STUDYING MASS SHOOTING TECHNIQUES FROM NEWS REPORTS
RISKAlert Report #1035 Updated: May 20, 2018 Santa Fe, Texas
At 7:25 am on a Friday morning in Santa Fe, Texas, a 17-year-old student walked into his classroom, wearing a trench coat and armed with his dad’s Remington 970 shotgun and .38 caliber pistol that he used to shoot 23 people inside his school. Ten were killed and 13 were injured in the planned shooting. Armed officers responded within four minutes and a gun battle
ensued with the subject.
Although a romantic failure may have triggered the attack, the shooter had long been a fan of active shooters and studied previous shootings, like pulling of the fire alarms in the recent Parkland shooting. He wore a trenchcoast, mirroring the horrific Columbine High School shooting in April, 1999, in which two teenage boys with weapons hidden under trench coats killed 12 students and one teacher
According to a witness, the shooter yelled “WOO HOO”, as he shot up the classroom. Multiple media accounts say the gunman taunted some of his victims, asking some hiding in a closet if they wanted to answer their ringing cell phones. “You want to get that?” the attacker said, according to The Wall Street Journal.
He spared others saying he wanted his story told. Police also found five homemade pipe bombs that did not detonate.
The shooter had pursued a romantic interest, Shana Fisher, for the past four month, according to her mother, but she refused to date him.Shana was shot and killed in the incident. Her mother said that the previous week, her daughter, Shana, has said in media accounts that her 16-year-old daughter had rejected four months of aggressive advances from Pagourtzis.
Fisher finally stood up to him in front of the entire class, and proclaimed she would never go out with him, embarrassing him in class, her mother told the Los Angeles Times.
Many of the aspects of the attack mirrored one of the worst school shootings in American history: the massacre at Columbine High School in April, 1999, in which two teenage boys with weapons hidden under trenchcoats killed 12 students and one teacher.
LESSONS LEARNED
1. Even with a relatively quick 4-minute response time, there were still 10 killed and 13 injured, demonstrating that even a well-armed police officer cannot quickly stop the killing, once shooting starts!!
Texas State officials blamed the attack on video games, on abortions, and on too many entrances and exits
to the high school buildings, even though the school lacked any access control, no metal detection and
no screening of any kind.
Underage students should not have ready access to firearms. The shooter’s parents apparently missed the fact that he assembled pipe bombs in his bedroom, had access to guns, and avidly recounted mass shootings.
Why are parents fined if their child is late in returning a library book, but not if their child shoots
and kills people with daddy’s guns?
The massacre claimed Shana Fisher’s life, and also claimed the lives of students Sabika Sheikh, a Pakistani exchange student; Chris Stone; Jared Black, Angelique Ramirez; Christian Riley Garcia; Aaron Kyle McLeod; and Kimberly Vaughan. Teachers Glenda Ann Perkins and Cynthia Tisdale were also killed.
The people hospitalized included retired Houston police Officer John Barnes, who served as a resource officer at the school and confronted the gunman.
Pagourtzis did not attempt suicide, like the Columbine shooters, but Texas’ governor, Greg Abbott, a Republican, told reporters that the youth wanted to kill himself, citing the suspect’s journals, but lacked the courage to do so.
Dimitrios Pagourtzis, is being held without bail and is accused of capital murder of multiple people and aggravated assault on a public servant. he suspect won’t face the death penalty if he is convicted. Under Texas law, offenders who are under age 18 and charged with a capital offense face a maximum punishment of life in prison with the possibility of parole after 40 years.
We provide the best Active Shooter Training, Workplace Violence Assessments, and & CMS Facility Risk Assessments, Drills & Training Programs. www.riskandsecurityllc.com and www.caroline-hamilton.com
A nineteen-year old woman is suing Beaumont Hospital in Dearborn, Michigan after she was injured by another patient in the hospital’s emergency room. The entire attack was caught on hospital security video.
The video showed the woman, who was wearing a hijab head scarf, had just started talking to the staff at the ER desk, when, with 5 seconds, an older man came up behind her and started to repeatedly punch her in the head. The man who attacked her, 57-year-old John Deliz, had been dropped off at the hospital by police, after leaving a group home.
Police records show he was warned about harassing others in the hospital lobby before the attack occurred, according to The Detroit News. Deliz admitted in court that that he had been diagnosed with bipolar disorder and schizophrenia and had not been taking his medications.
The hospital security staff immediately responded and restrained Deliz, who was subsequently arrested.
The lawsuit claims that “the hospital was aware of his condition as he was brought because he needed mental treatment. Instead of treating him, they discharged him into the ER waiting room,” her lawyer, Mr. Moughni told CBS. “Instead of giving him mental treatment, they put him back in the patient pool, thereby giving way to his attack.” LESSONS LEARNED:
1. Using the Emergency Room as a temporary holding area for behavioral health individuals exposes the hospital to potential lawsuits and liability for any damage they might do.
2. Behavioral health patients need to be isolated in a holding room and/or continuously supervised, and
not allowed to freely circulate within the Emergency Room.
Nasim Aghdam , a 39-year old YouTube user who was angry after access to her self-produced YouTube videos was reduced, drove 470 miles from Menifee in southern California to YouTube headquarters in northern California and shot three staff members with a handgun at the YouTube campus and then turned the gun on herself, inflicting a fatal injury.
Aghdam’s father, Ismail Aghdam said he had called the police, warning that she hated YouTube, and that he was afraid that she might be headed up to their headquarters after she went missing from her home.
She started shooting in a courtyard area and it appears she killed herself as law enforcement arrived on the scene. She was one of a handful of female shooters, and passionate about veganism and animal rights issues, and used her YouTube channel to spread her message. She ranted online against the company’s new policies and accused them of censoring her videos and reducing their views.
She had complained on her website that “new close-minded youtube employees” had “filtered my channels” starting
in 2016, causing the number of views on her videos to drop. She posted a screenshot of her YouTube page showing that one video had received 366,591 views.
YouTube staff members were terrorized by the random shootings, and were searched before
being allowed to go to their cars and leave the offices. It was the first major Workplace Violence
incident in a major Silicon Valley company and should encourage other companies to add more
security controls to their campuses.
LESSONS LEARNED:
1. A Workplace Violence Incident can happen anywhere and anytime! Be Ready.
Lack of access controls (metal detectors) allowed a killer to enter the YouTube campus with a
gun and shoot three staff members, injuring one critically. Simple, inexpensive metal detectors
could have eliminated this vulnerability.
Police did not respond quickly enough when they were called and alerted IN ADVANCE that the
shooter might be heading to the YouTube campus. She might have been apprehended on route
during the six plus hour drive to San Bruno.
The shooting took place after long-time nursing supervisor, Nancy Swift, 63, told off Trevis Coleman, a hospital Sterile Supply worker, described as “disgruntled” by police. After fatally shooting Swift, he shot instrument worker, Tim Isley, who is in critical condition. Coleman then turned the gun on himself, with a fatal shot to the head.
The incident took place at University of Alabama at Birmingham, Highlands’s hospital in Birmingham, Alabama. UAB Hospital Vice President Anthony Patterson said, ‘We have extensive security measures in place that include police officers on site 24-7 as well as others that we do not publicly disclose in the interest of safety.
“This is a sad day for Birmingham UAB. We lost a colleague and a friend last night,” UAB Hospital Vice President Anthony Patterson said. “First I want to offer my sincerest condolences to the victims who have suffered and to their family and colleagues who are grieving this senseless loss of life and injury, our highest priority is the health and safety of our patients and employees.”
The surviving victim of the shooting, 28-year-old Timothy Isley, is recovering at UAB Hospital. He was the on-duty instrument management supervisor at the time of the shooting. Isley’s father is a Mayor of Springville, Alabama,
UAB Highlands hospital had metal detectors in use at the time of the workplace violence incident.
LESSONS LEARNED:
‘Disgruntled’ employees need to have a formal case file opened on them, and their
behavior monitored, if they have the potential to be a threat.
Keeping all back entrances locked, and using door alarms, can keep staff, and intruders
from bringing guns and knives into hospitals.
Ambulance thief, Danny Lee Konieczny, 60, was drunk and suicidal when First Responders picked him
up after a neighbor called 911. He was transported to The Villages Regional Hospital, where
he waited two hours in the Emergency Department without seeing a doctor.
Frustrated and angry, he decided to steal the ambulance to drive the 5.7 miles to his home,
according to the arrest affidavit! He walked outside and stole a Sumter EMS Ambulance, which was
owned by Rural/Metro and equipped with a GPS tracking device. Rural/Metro personnel were able
to see the theft of the ambulance on a live feed and so deputies followed the GPS to Konieczny’s home.
The suspect had parked the ambulance in the neighbor’s
driveway, and then hid in the trunk of his car, where
officers found him and arrested him. Konieczny is now
facing a felony charge of grand theft of a motor vehicle
following the arrest by Lake County Sheriff’s deputies.
“He was upset because he was just put in the hallway
to wait and was not being seen at the hospital,” the
deputy wrote in the arrest report. The ambulance was
recovered intact and returned to Rural/Metro.
LESSONS LEARNED:
Ambulance theft is relatively common but easy to prevent. Experts recommend
making sure to turn off the engine and lock all ambulance doors.
There are keypad systems that can be installed to prevent someone from driving away in
an ambulance, when the engine has been left running.
“Good Guy with Gun” Didn’t Work at Parkland’s School Shooting Sheriff’s Deputy was Armed and
On site During Incident, but Stayed Out to Save Himself, Leaving Students and Staff to Die
RISKAlert Report Updated: Feb 23, 2018
According to Broward County Sheriff Scott Israel, there was an armed Sheriff’s deputy on the scene of the Parkland Massacre.
He stood outside while the shooter hunted down and murdered seventeen children and staff members. The deputy could hear the screaming and the gunfire. But he let the shooting carry on for minutes that literally meant life or death.
“I’m Devastated. Sick to my stomach. There are no words. These families lost their children. We lost coaches. I’ve been to the funerals,” Sheriff Israel, obviously shaken, said at a press conference on Thursday. Asked what the officer should have done, Israel responded, “Went in. Addressed the killer. Killed the killer.”
The cowardly deputy, Scott Peterson, who left the children to fend for themselves, was put on administrative leave and now has resigned. A security camera caught the deputy outside the building, within earshot of the shootings.
In the aftermath of the tragedy, other issues in the law enforcement response have come to light, including two other deputies were placed on restricted duty on Thursday because they may have mishandled tips called in to the sheriff’s office over the past two years warning that the suspect, Nikolas Cruz, appeared intent on becoming a school shooter, Sheriff Israel said
LESSONS LEARNED:
1. ACCESS CONTROL MAKES THE DIFFERENCE. Obviously, arming teachers
won’t work. Metal detectors work 100% of the time, and don’t hang back in
the parking lot.
2. Starting Monday, we can help schools LOCK THEIR DOORS, get some basic Access Controls in place, and commit to PROTECTING THESE STUDENTS!
As an active shooter expert, the last thing I expected yesterday was a shooting in my own neighborhood. I left a meeting at about 2:30 ET and noticed that there were sirens and emergency vehicles everywhere. They were racing to respond to an alert at Marjory Stoneman Douglas High School in Parkland, Fla., which has now become the site of one of the worst school shootings in American history.
Parkland is an affluent residential community that backs up to the Everglades. The school was named to honor Stoneman Douglas, an environmentalist who fought to protect Florida’s Everglades. In fact, just this week, the city was ranked as the 15th safest city in America and one of the safest cities in Florida.
But it could not be protected from an active shooter. Minutes after the ambulances flew by; I got the alert on my phone: an active shooter situation practically in my own backyard. By the next morning, we knew much more.
Initially, it was reported as one person dead but by late last night, however; the number had ballooned to 17 students and staff killed, and fifteen more in the hospital. It was the 18th school shooting of 2018, which averages out to almost one every other day so far this year.
A former student, identified as 19-year-old Nikolas Cruz, was arrested near the school. He allegedly entered the school with the other students and pulled the fire alarm, so they would run out into the hall where he opened fire. In addition to shooting students inside the building he also reportedly took aim at victims as they attempted to flee the hail of gunfire.
The shooter’s weapon of choice was an AR-15 semi-automatic rifle, which was purchased legally last year from a Broward County gun shop. Cruz made his first court appearance on Thursday and was charged with seventeen counts of first degree murder.
A student interviewed by the media said he knew the kid who had the gun, and that the student had shown him photos of guns on his phone. Cruz’s Instagram account also reportedly featured not only photos of guns, but of frogs and lizards he had tortured and then killed. According to published reports, he had posted on social media: “I’m going to be a professional school shooter.”
Many students who were interviewed yesterday and today said the shooter was someone they thought might have been a dangerous person. He had a troubled background, including behavioral problems, and had been recently expelled from the school.
As politicians on every TV channel discussed the future of gun control, the political aspects of America’s gun problem and the role of the National Rifle Association in effectively blocking gun legislation, the real truth is that we need to protect schools now, not fight endlessly about long term solutions. The great technological advances in security have created realistic security solutions that can better protect students and schools today.
Immediate Steps to Shore Up School Security
Access control is the starting point. If you can’t control access, anyone can bring any kind of guns into our schools. Stand-alone metal detectors are relatively inexpensive and easy to install. Wand scanners could be deployed tomorrow. Backpacks and cases need to be scanned or opened.
Limit and alarm entrances to the schools. No school is secure if there are multiple entrances, and if anyone can enter the school undetected. All exterior doors should be locked 100 percent of the time, not propped open, and doors should be checked weekly to make sure they close effectively.
Actively monitor security cameras. Cameras should be set up for active monitoring on every egress door, so that if a shooter somehow gets in, they can be discovered at the first shot and then isolated so that students are removed from the immediate area. Students could have been prevented from putting themselves in harm’s way, or even rescued.
Leverage gunshot detection solutions. Gunshot detection software can alert at the sound of the first round fired.
Color photo ID badges should be issued to every student and worn at all times. They cost almost nothing and instantly help to keep people out who should not be in the facility, such as the shooter who carried out this massacre.6. Use bullet-resistant backpacks and white boards. Though they can’t stop a gunman, these products can help children and staff protect themselves when all else fails.
Florida schools are required to “lockdown” if an active shooter code is called. This is not an effective procedure and the number of victims in the Parkland massacre show that it is ineffective. It does not limit the shooter once they are inside the facility and it prevents students from being able to exit quickly.
Once again, as was the case in the Pulse nightclub shooting in Orlando, we saw law enforcement holding back instead of entering the school sooner and finding and eliminating the shooter before he kills more students and then just strolls away down the street.
Long Term Solutions
Long term solutions should always be pursued but they must include a national discussion on access to lethal and automatic weapons. More stringent background checks need to be implemented, as we have seen with every active shooter incident, including the 2013 shooting at Los Angeles International Airport, the aforementioned massacre at the Pulse nightclub and even the 2016 New York bombing in which the suspect’s father called the FBI to report his child was planning to kill people and nothing was done.
These are long-term political solutions, but the conversation today and tomorrow and the day after that needs to be about preventing school shootings and mass casualty events, which require the implementation of mandatory controls/solutions that can be deployed tomorrow, not in three years.
Back in Parkland, this close knit community has been terrorized and there is no resolution. The most aggravating thing about the Parkland massacre is: one more time, it’s too late. No matter how many drills and training were done, it didn’t help.
About the Author:
Caroline Ramsey-Hamilton is a risk expert and Futurist, who creates innovative facility security risk assessment solutions, including how to prevent active shooters and workplace violence in healthcare, education, government, and manufacturing sectors. As part of the DoD Defense Industrial Base, she lives in South Florida near Parkland, and works every day to keep people safe.
