Summary St. Elizabeth's Medical Center (SEMC), a tertiary care hospital based in Brighton, Mass., agreed to pay $218,400 to address deficiencies in its HIPAA compliance activities. The SEMC settlement continues a pattern of enforcement actions from the Department of Health and Human Services (HHS) Office of Civil Rights (OCR) against hospitals and medical practices related to HIPAA compliance. In November 2012, OCR received a complaint from members of SEMC's workforce that SEMC was using an internet-based document sharing application that stored documents containing electronic protected health information (ePHI) of almost five hundred people without analyzing the risks of doing so. Separately, in August 2014, SEMC notified OCR of a breach of unsecured ePHI from a former SEMC workforce member's personal laptop and flash drive that affected approximately 600 individuals.