Lahey Hospital and Medical Center has settled with the U.S. Department of Health and Human Services' Office for Civil Rights for potential HIPAA violations related to lax security.

The nonprofit teaching hospital, which is affiliated with Tufts Medical School, will pay $850,000 and "will adopt a robust corrective action plan to correct deficiencies" in its HIPAA policies, according to an HHS news release.

The settlement has its roots in an incident four years ago, when Lahey notified OCR of a stolen laptop taken from an unlocked room there in August 2011.

The laptop, which operated the scanner and produced images for viewing through Lahey's RIS/PACS system, was on a stand that accompanied a portable CT scanner. Its hard drive contained the protected health information of 599 patients.

[Learn more: Meet the speakers at the HIMSS and Healthcare IT News Privacy and Security Forum.]

The subsequent investigation by OCR uncovered "widespread non-compliance with the HIPAA rules" at Lahey, according to HHS.

These included failures to conduct a thorough risk analysis of its electronic protected health information; physically safeguard a workstation that accessed patient data and maintain policies related to data security on workstations use in connection with diagnostic and lab equipment, the OCR report shows.

In addition, it cited Lahey for lack of a unique username to identify and track user identity with respect to the workstation at issue in this incident; failure to implement procedures that recorded and examined activity in the workstation at issue in this incident and impermissible disclosure of 599 individuals' PHI.

"It is essential that covered entities apply appropriate protections to workstations associated with medical devices such as diagnostic or laboratory equipment," said OCR Director Jocelyn Samuels, in a press statement. "Because these workstations often contain ePHI and are highly portable, such ePHI must be considered during an entity's risk analysis and entities must ensure necessary safeguards that conform to HIPAA's standards are in place."

Read more about the case on the OCR website.