Hamilton County moves risk management under COO amid HIPAA breach response; hires outside counsel for compliance review

Hamilton County commissioners on April 9 approved an amended resolution moving the countyrisk-management department from the County AttorneyOffice to the chief operating officer(COO) and separately authorized a contract of up to $40,000 with outside counsel to assess HIPAA and other compliance matters.

The action came after an extended public exchange over the countyresponse to a reported HIPAA breach and whether responsibility for risk management should remain with the County AttorneyOffice, be returned to Human Resources or be assigned to the COO. Commissioners voted to amend the transfer so risk management reports to the COO; the amended resolution was approved by the commission.

The amendment followed a series of motions and a failed attempt to defer action while the commission awaited an outside assessment. County Attorney Tyler Taylor told commissioners the office learned the magnitude of the breach in March and that the office has been working since then on required steps, including notification language. "The key number, as you all have been told, is 500," Taylor said, referring to the number of records involved. Mayor Wong said the county had 60 days from notification to complete required communications and that about 15 days remained. "We have 15 days from today to notify everybody affected by the HIPAA breach," the mayor said during the discussion.

Commissioner Helton moved the amendment that placed risk management under the COO; Commissioner Smith seconded that amendment. Commissioner…