Upcoming Webinars

Site Updates

Disclaimer

The analysis of any legal or medical billing is dependent on numerous specific facts — including the factual situations present related to the patients, the practice, the professionals and the medical services and advice. Additionally, laws and regulations and insurance and payer policies are subject to change. The information that has been accurate previously can be particularly dependent on changes in time or circumstances. The information contained in this web site is intended as general information only. It is not intended to serve as medical, health, legal or financial advice or as a substitute for professional advice of a medical coding professional, healthcare consultant, physician or medical professional, legal counsel, accountant or financial advisor. If you have a question about a specific matter, you should contact a professional advisor directly. CPT copyright American Medical Association. All rights reserved. CPT is a registered trademark of the American Medical Association.

Menu
Log in
Forgot password


Search
Log in
Forgot password
  • Home
  • HIPAA
  • HIPAA Compliance Updates and Information

HIPAA Compliance Updates

Welcome to out HIPAA compliance updates and news.  Here we post news, articles, and site updates on HIPAA.  

<< First  < Prev   1   2   3   4   5   ...   Next >  Last >> 

  • HHS Office for Civil Rights Settles with Health Care Clearinghouse, Inmediata Health Group, Over HIPAA Impermissible Disclosure

    10 Dec 2024 9:59 AM | Zachary Edgar (Administrator)

    Today, the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR) announced a settlement with Inmediata Health Group, LLC (Inmediata), a health care clearinghouse, concerning potential violations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Security Rule, following OCR’s receipt of a complaint that HIPAA protected health information was accessible to search engines like Google, on the internet.

    “Health care entities must ensure that they are not leaving patient health information accessible online to anyone with an internet connection,” said OCR Director Melanie Fontes Rainer. “Effective cybersecurity means being proactive and vigilant in searching for risks and vulnerabilities to health data and preventing unauthorized access to patient health information.”

    OCR enforces the HIPAA Privacy, Security, and Breach Notification Rules, which sets forth the requirements that health plans, health care clearinghouses, and most health care providers, and their business associates must follow to protect the privacy and security of protected health information (PHI). The HIPAA Security Rule establishes national standards to protect individuals’ electronic personal health information that is created, received, used, or maintained by a covered entity. It also requires appropriate administrative, physical and technical safeguards to ensure the confidentiality, integrity, and security of electronic protected health information (ePHI).

    In 2018, OCR received a complaint concerning PHI left unsecured on the internet. Following the initiation of OCR’s investigation, Inmediata provided breach notification to HHS, and affected individuals. OCR’s investigation determined that from May 2016 through January 2019, the PHI of 1,565,338 individuals was made publicly available online. The PHI disclosed included patient names, dates of birth, home addresses, Social Security numbers, claims information, diagnosis/conditions and other treatment information. These impermissible disclosures of PHI were potential violations of the HIPAA Privacy Rule.

    OCR’s investigation also identified multiple potential HIPAA Security Rule violations including: failures by Inmediata to conduct a compliant risk analysis to determine the potential risks and vulnerabilities to ePHI in its systems; and to monitor and review its health information systems’ activity. The settlement resolves OCR’s investigation concerning this HIPAA breach.

    Under the terms of the settlement, Inmediata paid OCR $250,000. OCR determined that a corrective action plan was not necessary in this resolution as Inmediata had previously agreed to a settlement - PDF with 33 states that includes corrective actions that address OCR’s findings in this matter.

    OCR recommends health care providers, health plans, clearinghouses, and business associates that are covered by HIPAA take the following steps to protect ePHI:

    • Review all vendor and contractor relationships to ensure business associate agreements are in place as appropriate and address breach/security incident obligations.
    • Integrate risk analysis and risk management into business processes; conducted regularly and when new technologies and business operations are planned.
    • Ensure audit controls are in place to record and examine information system activity.
    • Implement regular review of information system activity.
    • Utilize multi-factor authentication to ensure only authorized users are accessing ePHI.
    • Encrypt ePHI to guard against unauthorized access to ePHI.
    • Incorporate lessons learned from incidents into the overall security management process.
    • Provide training specific to organization and job responsibilities and on regular basis; reinforce workforce members’ critical role in protecting privacy and security.

    The resolution agreement may be found at: https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/inmediata-health-group-ra-cap/index.html

    Reference

    HIPAA News Releases & Bulletins


  • HHS Office for Civil Rights Imposes a $1.19 Million Penalty Against Gulf Coast Pain Consultants for HIPAA Security Rule Violations

    3 Dec 2024 9:58 AM | Zachary Edgar (Administrator)

    Today, the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR) announced a $1.19 million civil monetary penalty against Gulf Coast Pain Consultants, LLC d/b/a Clearway Pain Solutions Institute (Gulf Coast Pain Consultants) in Florida, concerning violations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Security Rule, following receipt of a breach report that a former contractor for the company had impermissibly accessed their electronic record system. OCR enforces the HIPAA Privacy, Security, and Breach Notification Rules, which set forth the requirements that health plans, health care clearinghouses, and most health care providers, and their business associates must follow to protect the privacy and security of protected health information (PHI). The HIPAA Security Rule establishes national standards to protect and secure our health care system by requiring administrative, physical and technical safeguards to ensure the confidentiality, integrity, and security of electronic PHI (ePHI).

    “Current and former workforce can present threats to health care privacy and security—risking continuity of care and trust in our health care system,” said OCR Director Melanie Fontes Rainer. “Effective cybersecurity and compliance with the HIPAA Security Rule means being proactive in reviewing who has access to health information and responding quickly to suspected security incidents.”

    OCR initiated an investigation following the receipt of a breach report filed by Gulf Coast Pain Consultants, which reported that a former contractor had impermissibly accessed Gulf Coast’s electronic medical record system to retrieve PHI for use in potential fraudulent Medicare claims. OCR’s investigation determined that the impermissible access occurred on three occasions, affecting approximately 34,310 individuals. The compromised PHI included patient names, addresses, phone numbers, email addresses, dates of birth, Social Security numbers, chart numbers, insurance information, and primary care information.

    OCR found four violations by Gulf Coast Pain Consultant of the HIPAA Security Rule, including failures to:

    • conduct an accurate and thorough risk analysis to determine the potential risks and vulnerabilities to ePHI in its systems;
    • implement procedures to regularly review records of activity in information systems;
    • implement procedures to terminate former workforce members’ access to ePHI; and
    • implement procedures for establishing and modifying workforce members’ access to information systems.

    In August 2024, OCR issued a Notice of Proposed Determination seeking to impose a civil money penalty. Gulf Coast waived its right to a hearing and did not contest OCR’s findings. Accordingly, OCR imposed a civil money penalty of $1,190,000.

    The Notice of Proposed Determination may be found at: https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/gulf-coast-pain-consultants-npd/index.html

    The Notice of Final Determination may be found at: https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/gulf-coast-pain-consultants-nfd/index.html

    OCR recommends that health care providers, health plans, clearinghouses, and business associates that are covered by HIPAA take the following steps to mitigate or prevent cyber threats:

    • Integrate risk analysis and risk management into business processes.
    • Implement regular review of information system activity.
    • Implement procedures for terminating access to ePHI when the employment of, or other arrangement with, a workforce member ends.
    • Implement procedures for modifying a user’s right of access to a workstation, transaction, program or process, or an alternative equivalent measure.

    OCR regularly provides guidance and information to the health care industry to support data privacy and security. Recent resources include:

    Reference

    HIPAA News Releases & Bulletins


  • HHS Office for Civil Rights Settles with Holy Redeemer Family Medicine Over Disclosure of Patient’s Protected Health Information, Including Reproductive Health Information

    26 Nov 2024 9:56 AM | Zachary Edgar (Administrator)

    Today, the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR) announced a settlement with Holy Redeemer Family Medicine (Holy Redeemer), a Pennsylvania hospital, concerning an alleged violation of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule due to an impermissible disclosure of a female patient’s protected health information, including information related to reproductive health care. OCR enforces the HIPAA Privacy, Security, and Breach Notification Rules, which set forth the requirements that covered entities (health plans, health care clearinghouses, and most health care providers) and business associates must follow relating to the privacy and security of protected health information. The HIPAA Privacy Rule establishes national standards to protect individuals’ medical records, requires appropriate safeguards to protect the privacy of protected health information and sets limits and conditions on the uses and disclosures that may be made of such information without an individual’s authorization, (such as disclosures for health oversight activities or for law enforcement purposes), and gives individuals rights such as the ability to access their own medical records.

    “It is imperative that health care providers take their duty to protect patient privacy seriously and follow the law,” said OCR Director Melanie Fontes Rainer. “Patients must be able to trust that sensitive, health information in their files is protected to preserve their trust in the patient-doctor relationship and ensure they get the care they need. This is particularly true for reproductive health privacy.”

    In September of 2023, OCR received a complaint alleging that Holy Redeemer impermissibly disclosed a female patient’s protected health information to the patient’s prospective employer, including her surgical history, gynecological history, obstetric history, and other sensitive health information concerning reproductive health care. OCR’s investigation found that Holy Redeemer disclosed the patient’s full medical record, including protected health information concerning her reproductive health care, that it did not have the patient’s authorization for the broad disclosure of her protected health information, and that there otherwise was no applicable requirement or permission under the Privacy Rule for such a broad release of her medical records.  The complainant stated that she had requested that Holy Redeemer send one specific test result, unrelated to her reproductive health, to a prospective employer.

    Under the terms of the resolution agreement, Holy Redeemer paid $35,581 and agreed to implement a corrective action plan that identifies specific steps it will take to comply with the HIPAA Rules and protect patient privacy to prevent this from happening again. OCR will monitor the implementation of this corrective action plan for two years:

    • Submit a breach notification report to HHS regarding this incident;
    • Review, develop or revise its policies and procedures to ensure compliance with the Privacy Rule, and submit all such policies and procedures to HHS for approval;
    • Distribute all HHS-approved policies and procedures to its workforce and ensure that each member of the workforce certifies receipt and understanding of the policies and procedures;
    • Train all members of its workforce on its HHS-approved policies and procedures, including all workforce members of its affiliated entities;
    • Within 120 days after HHS approval of Holy Redeemers policies and procedures, Holy Redeemer must submit a written report to HHS detailing the status of its implementation of the corrective action plan;
    • Provide a report to OCR regarding any non-compliance with its policies and procedures by any members of its workforce;
    • Provide annual reports to OCR regarding Holy Redeemer’s compliance with the corrective action plan.

    The resolution agreement and corrective action plan may be found at: https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/holy-redeemer-hospital-ra-cap/index.html.

    OCR is committed to ensuring the privacy of lawful reproductive health care. Please see OCR’s 2024 final rule on HIPAA Privacy Rule to Support Reproductive Health Care Privacy for more information.

    Reference

    HIPAA News Releases & Bulletins


  • HHS Office for Civil Rights Imposes a $100,000 Penalty Against Mental Health Center for Failure to Provide Timely Access to Patient Records

    19 Nov 2024 9:56 AM | Zachary Edgar (Administrator)

    Today, the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR), announced a $100,000 civil monetary penalty against Rio Hondo Community Mental Health Center (“Rio Hondo”) in California. The penalty resolves an investigation into Rio Hondo over a failure to provide a patient with timely access to their medical records. The Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule’s right of access provisions require that individuals or their personal representatives have timely access to their health information (within 30 days, with the possibility of one 30-day extension) and for a reasonable, cost-based fee. OCR enforces the HIPAA Privacy Rule, which establishes national standards to protect individuals’ medical records; sets limits and conditions on the uses and disclosures of protected health information; and gives individuals certain rights, including the right to timely access and to obtain a copy of their health records.

    “Patients should never be in the position of needing to request their own medical records over and over again before getting access to them,” said OCR Director Melanie Fontes Rainer. “Ensuring patients’ rights to timely access to medical information continues to be a HIPAA enforcement priority. Healthcare providers are legally obligated to provide patients with timely access to their medical records. If they fail to provide that access, OCR will not hesitate to do everything in its power, including imposing civil monetary penalties, to ensure compliance with the law.”

    OCR launched an investigation after receiving a complaint from a patient that they were not given timely access to their medical records, despite multiple requests in writing and by telephone. OCR’s investigation found that it took nearly seven months from the time the patient first requested the records until Rio Hondo provided them. The patient made multiple telephone calls in July and August 2020, regarding the status of her request, but still did not receive the requested records. Based on the facts, OCR found that Rio Hondo failed to take timely action in response to the patient’s right of access in accordance with the HIPAA Privacy Rule. In July 2024, OCR issued a Notice of Proposed Determination to impose a $100,000 civil monetary penalty. Rio Hondo waived its right to a hearing and did not contest the findings of OCR’s Notice of Proposed Determination. As a result of OCR’s investigation, the patient received their records in 2020.

    The Notice of Proposed Determination may be found at: https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/rio-hondo/notice-proposed-determination/index.html

    The Notice of Final Determination may be found at: https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/rio-hondo/notice-final-determination/index.html

    OCR’s guidance on the HIPAA right of access is available at: https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html.

    Reference

    HIPAA News Releases & Bulletins


  • HHS Office for Civil Rights Settles Ransomware Cybersecurity Investigation for $500,000

    31 Oct 2024 9:55 AM | Zachary Edgar (Administrator)

    Today, the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR), announced a settlement with Plastic Surgery Associates of South Dakota in Sioux Falls, for several potential violations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Security Rule, following its investigation into a ransomware attack breach by OCR. Ransomware and hacking are the primary cyber-threats in health care.

    Ransomware is a type of malware (malicious software) designed to deny access to a user’s data, usually by encrypting the data with a key known only to the hacker who deployed the malware, until a ransom is paid.  There has been a 264% increase in large breaches reported to OCR involving ransomware attacks since 2018. October is Cybersecurity Awareness Month, and OCR has been working with health plans, health care clearinghouses, most health care providers and their business associates to raise awareness of the types of cyberattacks occurring and how to improve data security.

    “Ransomware attacks often reveal a provider’s underlying failures to comply with the HIPAA Security Rule requirements such as conducting a risk analysis or managing identified risks and vulnerabilities to health information,” said OCR Director Melanie Fontes Rainer. “Such failures can make our doctors and hospitals attractive targets for cyberattacks and can lead to break downs in our health care system.”

    OCR enforces the HIPAA Privacy, Security, and Breach Notification Rules, which set forth the requirements that covered entities (health plans, health care clearinghouses, and most health care providers), and business associates must follow to protect the privacy and security of protected health information. The HIPAA Security Rule establishes national standards to protect individuals' electronic protected health information (ePHI) that is created, received, used, or maintained by a covered entity. It also requires appropriate administrative, physical, and technical safeguards to ensure the confidentiality, integrity, and security of ePHI. The settlement resolves OCR’s investigation concerning Plastic Surgery Associates of South Dakota and this ransomware attack.

    OCR initiated an investigation following the receipt of a breach report filed by Plastic Surgery Associates of South Dakota in July 2017, which reported that it discovered that nine workstations and two servers were infected with ransomware, affecting the protected health information of 10,229 individuals. The credentials the hacker(s) used to access Plastic Surgery Associates of South Dakota’s network were obtained through a brute force attack (hacking method that uses trial and error to guess passwords, login information, encryption keys, etc.) to their remote desktop protocol. After discovering the breach, Plastic Surgery Associates of South Dakota was unable to restore the affected servers from backup.

    OCR’s investigation revealed multiple potential violations of the HIPAA Security Rule, including failures to conduct a compliant risk analysis to determine the potential risks and vulnerabilities to ePHI in its systems; implement security measures sufficient to reduce the risks and vulnerabilities to ePHI to a reasonable and appropriate level; implement procedures to regularly review records of information system activity; and implement policies and procedures to address security incidents.

    Under the terms of the settlement, Plastic Surgery Associates of South Dakota paid $500,000 to OCR and agreed to implement a corrective action plan that requires them to take steps to resolve potential violations of the HIPAA Security Rule and protect the security of electronic protected health information, including:

    • Conduct an accurate and thorough risk analysis to determine the potential risks and vulnerabilities to the confidentiality, integrity, and availability of its ePHI;
    • Implement a written risk management plan to address and mitigate security risks and vulnerabilities identified in the Risk Analysis;
    • Implement policies and procedures to address security incidents, including a process for: identifying and responding to known security incidents; mitigating, to the extent practicable, harmful effects of known security incidents; and documenting (in writing) security incidents and their outcomes;
    • Implement policies and procedures to establish methods to create and maintain retrievable exact copies of ePHI, including a process to: test the recoverability of backups on a regular basis to ensure that a retrievable exact copy will be available; create and maintain multiple copies of encrypted backups; and securely store backups in differing locations;
    • Implement policies and procedures to verify that a person or entity seeking access to ePHI is the one claimed;
    • Implement policies and procedures for electronic information systems that maintain ePHI to allow access only to those persons or software programs that have been granted access rights;
    • Revise its policies and procedures relating to the uses and disclosures of PHI to ensure that its workforce members understand: 1) the circumstances under which PHI may be used and disclosed; 2) how to identify situations that constitute impermissible uses and disclosures of PHI; and 3) how and when to report situations that might constitute impermissible uses and/or disclosures of PHI;
    • Revise its Breach Notification policies and procedures to ensure that its workforce members understand that, following a breach of unsecured PHI, affected individuals must be notified without unreasonable delay and in no case later than 60 (sixty) calendar days after the discovery of the breach, and that notification must be made to the HHS Secretary and, in certain circumstances, to the media; and
    • Provide training to its workforce on HIPAA policies and procedures.

    OCR will monitor Plastic Surgery Associates of South Dakota for two years to ensure compliance with the law.

    ***

    OCR recommends health care providers, health plans, clearinghouses, and business associates that are covered by HIPAA take the following steps to mitigate or prevent cyber-threats:

    • Review all vendor and contractor relationships to ensure business associate agreements are in place as appropriate and address breach/security incident obligations.
    • Integrate risk analysis and risk management into business processes; conducted regularly and when new technologies and business operations are planned.
    • Ensure audit controls are in place to record and examine information system activity.
    • Implement regular review of information system activity.
    • Utilize multi-factor authentication to ensure only authorized users are accessing ePHI.
    • Encrypt ePHI to guard against unauthorized access to ePHI.
    • Incorporate lessons learned from incidents into the overall security management process.
    • Provide training specific to organization and job responsibilities and on a regular basis; reinforce workforce members’ critical role in protecting privacy and security.

    OCR regularly provides guidance and information to the health care industry to support data privacy and security. As part of this ongoing initiative, this past Fall, OCR provided the following resources:

    The resolution agreement and corrective action plan may be found at: https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/psa-ra-cap/index.html

    Reference

    HIPAA News Releases & Bulletins


  • HHS Office for Civil Rights Imposes a $70,000 Civil Monetary Penalty Against Gums Dental Care for Failure to Provide Timely Access to Patient Records

    17 Oct 2024 9:54 AM | Zachary Edgar (Administrator)

    Today, the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR), announced a $70,000 civil monetary penalty against Gums Dental Care, LLC (Gums Dental Care), a solo dental practice in Maryland that provides family dental care, as a result of an investigation based on a complaint that Gums Dental had failed to provide a patient with timely access to their medical records. The Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule’s right of access provisions require that individuals or their personal representatives have timely access to their health information (within 30 days, with the possibility of one 30-day extension) and for a reasonable, cost-based fee.

    “An essential hallmark of HIPAA is the right to patients’ timely access to their medical records. Patients should not have to make multiple requests and file complaints with HHS’ Office for Civil Rights to get their own medical records,” said OCR Director Melanie Fontes Rainer. “This investigation marks OCR’s 50th right of access enforcement action. Health care providers should get the message—loud and clear—when a patient seeks their medical information, you must provide it to them, period.”

    OCR enforces the HIPAA Privacy, Security, and Breach Notification Rules, which set forth the requirements that covered entities (health plans, health care clearinghouses, and most health care providers) and business associates must follow relating to the privacy and security of protected health information. The HIPAA Privacy Rule establishes national standards to protect individuals’ medical records, sets limits and conditions on the uses and disclosures of protected health information, and gives individuals certain rights, including the right to timely access and to obtain a copy of their health records.  This is a critical part of HIPAA and patient’s empowerment with their data.

    OCR first received a complaint alleging that Gums Dental Care had failed to provide the complainant access to her and her children’s medical records. OCR sent a technical assistance letter notifying Gums Dental Care of its obligation to respond to requests for medical records and closed the complaint. After the complainant filed a second complaint alleging Gums Dental Care had still not provided complainant with access to the requested records, OCR opened an investigation. OCR’s investigation found that Gums Dental Care failed to take timely action in response to the patient’s right of access request. Specifically, Complainant submitted written requests for the records in April 2019, and again in June 2019, but Gums Dental Care did not attempt to provide the records until May 2022. In March 2022, OCR issued a Notice of Proposed Determination seeking to impose a $70,000 civil monetary penalty. Gums Dental Care challenged OCR’s Notice of Proposed Determination and requested a hearing before an Administrative Law Judge (ALJ). On September 29, 2023, the ALJ imposed a $70,000 civil monetary penalty. Gums Dental Care appealed the decision, and on March 22, 2024, the Departmental Appeals Board affirmed the Decision. Accordingly, OCR imposed the $70,000 civil monetary penalty in a Notice of Final Determination.

    The Notice of Proposed Determination may be found at: https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/gums-dental-care-npd/index.html.

    OCR’s guidance on the HIPAA right of access is available at: https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html.

    Reference

    HIPAA News Releases & Bulletins


  • HHS Office for Civil Rights Imposes a $240,000 Civil Monetary Penalty Against Providence Medical Institute in HIPAA Ransomware Cybersecurity Investigation

    3 Oct 2024 9:54 AM | Zachary Edgar (Administrator)

    Today, the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR) announced a $240,000 civil monetary penalty against Providence Medical Institute in Southern California, concerning potential violations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Security Rule, following a ransomware attack breach report investigation by OCR. Ransomware and hacking are the primary cyber-threats in health care. There has been a 264% increase in large breaches reported to OCR involving ransomware attacks since 2018.

    “Failures to fully implement all of the HIPAA Security Rule requirements leaves HIPAA covered entities and business associates vulnerable to cyberattacks at the expense of the privacy and security of patients’ health information,” said OCR Director Melanie Fontes Rainer. “The health care sector needs to get serious about cybersecurity and complying with HIPAA. OCR will continue to stand up for patient privacy and work to ensure the security of health information of every person. On behalf of OCR, I urge all health care entities to always stay alert and take every precaution and steps to keep their systems safe from cyberattacks.”

    OCR enforces the HIPAA Privacy, Security, and Breach Notification Rules, which sets forth the requirements that covered entities (health plans, health care clearinghouses, and most health care providers), and business associates must follow to protect the privacy and security of protected health information. The HIPAA Security Rule establishes national standards to protect individuals' electronic personal health information that is created, received, used, or maintained by a covered entity. It also requires appropriate administrative, physical and technical safeguards to ensure the confidentiality, integrity, and security of electronic protected health information. The Civil Money Penalty resolves OCR’s investigation concerning Providence Medical Institute’s compliance with the HIPAA Security Rule.

    OCR initiated an investigation following the receipt of a breach report filed by Providence Medical Institute in April 2018, which reported that its systems were impacted by a series of ransomware attacks that affected the electronic protected health information (ePHI) of 85,000 individuals between February and March 2018. OCR’s investigation determined that servers containing ePHI were encrypted with ransomware three times. OCR found two potential violations of the HIPAA Security Rule, including failure to have a business associate agreement in place and failure to implement policies and procedures to allow only authorized persons or software programs access to ePHI.

    In March 2024, OCR issued a Notice of Proposed Determination seeking to impose a civil money penalty. Providence Medical Institute waived its right to a hearing and did not contest OCR’s findings. Accordingly, OCR imposed a civil money penalty of $240,000.

    The Notice of Proposed Determination may be found at: https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/pmi-npd/index.html

    The Notice of Final Determination may be found at: https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/pmi-nfd/index.html

    OCR recommends that health care providers, health plans, clearinghouses, and business associates that are covered by HIPAA take the following steps to mitigate or prevent cyber-threats:

    • Review all vendor and contractor relationships to ensure business associate agreements are in place as appropriate and address breach/security incident obligations.
    • Integrate risk analysis and risk management into business processes; conducted regularly and when new technologies and business operations are planned.
    • Ensure audit controls are in place to record and examine information system activity.
    • Implement regular review of information system activity.
    • Utilize multi-factor authentication to ensure only authorized users are accessing ePHI.
    • Encrypt ePHI to guard against unauthorized access to ePHI.
    • Incorporate lessons learned from incidents into the overall security management process.
    • Provide training specific to organization and job responsibilities and on regular basis; reinforce workforce members’ critical role in protecting privacy and security.

    The HHS Breach Portal: Notice to the Secretary of HHS Breach of Unsecured Protected Health Information may be found at: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf

    Reference

    HIPAA News Releases & Bulletins


  • HHS Office for Civil Rights Settles Ransomware Cybersecurity Investigation under HIPAA Security Rule for $250,000

    26 Sep 2024 9:52 AM | Zachary Edgar (Administrator)

    Today, the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR) announced a settlement with Cascade Eye and Skin Centers, P.C., a privately-owned health care provider in the state of Washington, concerning potential violations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Security Rule, following a ransomware attack investigation by OCR. Ransomware and hacking are the primary cyber-threats in health care. Since 2018, there has been a 264% increase in large breaches reported to OCR involving ransomware attacks.

    “Cybercriminals continue to target the heath care sector with ransomware attacks. Health care entities that do not thoroughly assess the risks to electronic protected health information and regularly review the activity within their electronic health record system leave themselves vulnerable to attack, and expose their patients to unnecessary risks of harm,” said OCR Director Melanie Fontes Rainer. “Ensuring the confidentiality of electronic protected health information is critical to protect health information privacy and integral to our national security in the health care sector. OCR urges all health care entities to take the essential precautions and stay vigilant to safeguard their systems from cyberattacks.”

    OCR enforces the HIPAA Privacy, Security, and Breach Notification Rules, which sets forth the requirements that health plans, health care clearinghouses, and most health care providers, and their business associates must follow to protect the privacy and security of protected health information (PHI). The HIPAA Security Rule establishes national standards to protect individuals’ electronic personal health information that is created, received, used, or maintained by a covered entity. It also requires appropriate administrative, physical and technical safeguards to ensure the confidentiality, integrity, and security of electronic protected health information. The settlement resolves OCR’s investigation concerning Cascade Eye and Skin Centers’ compliance with the HIPAA Security Rule.

    OCR initiated an investigation following the receipt of a complaint alleging that Cascade Eye and Skin Centers experienced a ransomware attack. OCR’s investigation determined that approximately 291,000 files that contained electronic PHI (ePHI) were affected. OCR found multiple potential violations of the HIPAA Security Rule, including failures by Cascade Eye and Skin Centers to conduct a compliant risk analysis to determine the potential risks and vulnerabilities to ePHI in its systems, and to have sufficient monitoring of its health information systems’ activity to protect against a cyber-attack.

    Under the terms of the settlement, Cascade Eye and Skin Centers has paid $250,000 to OCR and will implement a corrective action plan that requires Cascade Eye and Skin Centers to take steps toward protecting and securing the security of protected health information. OCR will monitor the corrective action plan for two years. These actions include:

    • Conduct an accurate and thorough risk analysis to determine the potential risks and vulnerabilities to the confidentiality, integrity, and availability of its ePHI;
    • Implement a risk management plan to address and mitigate security risks and vulnerabilities identified in their risk analysis;
    • Developing a written process to regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports;
    • Developing policies and procedures for responding to an emergency or other occurrence that damages systems that contain ePHI;
    • Developing written procedures to assign a unique name and/or number for identifying and tracking user identity in its systems that contain ePHI;
    • Reviewing and revising, if necessary, written policies and procedures to comply with the HIPAA Privacy and Security Rules.

    OCR recommends health care providers, health plans, clearinghouses, and business associates that are covered by HIPAA take the following steps to mitigate or prevent cyber-threats:

    • Review all vendor and contractor relationships to ensure business associate agreements are in place as appropriate and address breach/security incident obligations.
    • Integrate risk analysis and risk management into business processes; conducted regularly and when new technologies and business operations are planned.
    • Ensure audit controls are in place to record and examine information system activity.
    • Implement regular review of information system activity.
    • Utilize multi-factor authentication to ensure only authorized users are accessing ePHI.
    • Encrypt ePHI to guard against unauthorized access to ePHI.
    • Incorporate lessons learned from incidents into the overall security management process.
    • Provide training specific to organization and job responsibilities and on regular basis; reinforce workforce members’ critical role in protecting privacy and security.

    The resolution agreement and corrective action plan may be found at: https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/cascade-eye-skin-centers-ra-cap/index.html

    The HHS Breach Portal: Notice to the Secretary of HHS Breach of Unsecured Protected Health Information may be found at: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf

    Reference

    HIPAA News Releases & Bulletins

  • HHS Office for Civil Rights Imposes a Civil Monetary Penalty of $115,200 Against American Medical Response for Failure to Provide Timely Access to Patient Records

    1 Aug 2024 9:51 AM | Zachary Edgar (Administrator)

    Today, the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR) announced a civil monetary penalty of $115,200 collected against American Medical Response (AMR), a provider of emergency medical services across the United States. The civil monetary penalty was the result of an investigation based on a complaint that AMR had failed to provide a patient with timely access to their medical records. The Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule’s right of access provisions require that individuals or their personal representatives have timely access to their health information (within 30 days, with the possibility of one 30-day extension) and for a reasonable, cost-based fee.

    “HIPAA gives patients a right to timely access to their medical records,” said OCR Director Melanie Fontes Rainer. “OCR will continue to enforce this right through investigations, and when necessary, by imposing civil money penalties.”

    OCR enforces the HIPAA Privacy, Security, and Breach Notification Rules, which set forth the requirements that covered entities (health plans, health care clearinghouses, and most health care providers) and business associates must follow relating to the privacy and security of protected health information. The HIPAA Privacy Rule establishes national standards to protect individuals’ medical records, sets limits and conditions on the uses and disclosures of protected health information, and gives individuals certain rights, including the right to timely access and to obtain a copy of their health records.

    OCR received a complaint alleging that AMR failed to provide a patient with timely access to their medical records after many failed attempts by the patient. OCR initiated an investigation and found that AMR failed to provide the patient with timely access to their medical records. In response to OCR’s investigation, AMR sent the patient a copy of their requested records and amended its internal procedures to streamline and better track right of access requests to follow the law. In October 2023, OCR issued a Notice of Proposed Determination seeking to impose a civil money penalty.  AMR waived its right to a hearing and did not contest OCR’s findings. OCR finalized its determination and imposed the civil money penalty against AMR.

    View the Notice of Proposed Determination and Notice of Final Determination - PDF.

    Read about OCR’s guidance on the HIPAA right of access.

    Reference

    HIPAA News Releases & Bulletins


  • HHS Office for Civil Rights Settles HIPAA Security Rule Failures for $950,000

    1 Jul 2024 9:50 AM | Zachary Edgar (Administrator)

    Today, the U.S. Department of Health and Human Services’ (HHS) Office for Civil Rights (OCR) announced a settlement with Heritage Valley Health System (Heritage Valley), which provides care in Pennsylvania, Ohio and West Virginia, concerning potential violations of the Health Insurance Portability and Accountability Act (HIPAA) Security Rule, following a ransomware attack. Ransomware and hacking are the primary cyber-threats in health care. Since 2018, there has been a 264% increase in large breaches reported to OCR involving ransomware attacks.

    “Hacking and ransomware are the most common type of cyberattacks within the health care sector. Failure to implement the HIPAA Security Rule requirements leaves health care entities vulnerable and makes them attractive targets to cyber criminals,” said OCR Director Melanie Fontes Rainer. “Safeguarding patient protected health information protects privacy and ensures continuity of care, which is our top priority. We remind and urge health care entities to protect their records systems and patients from cyberattacks.”

    OCR enforces the HIPAA Privacy, Security, and Breach Notification Rules, which sets forth the requirements that covered entities (health plans, health care clearinghouses, and most health care providers), and business associates must follow to protect the privacy and security of protected health information. The settlement resolves OCR’s investigation concerning Heritage Valley’s compliance with the HIPAA Security Rule.

    OCR’s investigation revealed multiple potential violations of the HIPAA Security Rule, including failures by Heritage Valley to: conduct a compliant risk analysis to determine the potential risks and vulnerabilities to electronic protected health information in its systems; implement a contingency plan to respond to emergencies, like a ransomware attack, that damage systems that contain electronic protected health information; and implement policies and procedures to allow only authorized users access to electronic protected health information.

    Under the terms of the resolution agreement, Heritage Valley agreed to pay $950,000 and implement a corrective action plan that will be monitored by OCR for three years.

    Under the plan Heritage Valley will take a number of steps to resolve potential violations of the HIPAA Security Rule and protect the security of electronic protected health information, including:

    • Conduct an accurate and thorough risk analysis to determine the potential risks and vulnerabilities to the confidentiality, integrity, and availability of its electronic protected health information;
    • Implement a risk management plan to address and mitigate security risks and vulnerabilities identified in their risk analysis;
    • Review and develop, maintain, and revise, as necessary its written policies and procedures to comply with the HIPAA Rules; and
    • Train their workforce on their HIPAA policies and procedures.

    OCR recommends health care providers, health plans, clearinghouses, and business associates that are covered by HIPAA take the following steps to mitigate or prevent cyber-threats:

    • Review all vendor and contractor relationships to ensure business associate agreements are in place as appropriate and address breach/security incident obligations.
    • Integrate risk analysis and risk management into business processes; conducted regularly and when new technologies and business operations are planned.
    • Ensure audit controls are in place to record and examine information system activity.
    • Implement regular review of information system activity.
    • Utilize multi-factor authentication to ensure only authorized users are accessing electronic protected health information (ePHI).
    • Encrypt ePHI to guard against unauthorized access to ePHI.
    • Incorporate lessons learned from incidents into the overall security management process.
    • Provide training specific to organization and job responsibilities and on regular basis; reinforce workforce members’ critical role in protecting privacy and security.

    The resolution agreement and corrective action plan may be found at: https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/hvhs-ra-cap/index.html

    Reference

    HIPAA News Releases & Bulletins


<< First  < Prev   1   2   3   4   5   ...   Next >  Last >> 

About Us

Zachary Edgar JD, LLM is the managing partner for Therapy Comply.  Zachary is a healthcare attorney that specializes in federal and state healthcare regulatory issues particularly for physical, occupational, and speech therapy practices.  

Learn More 

Join Us

Join today as a yearly member and enjoy full access to the site and a significant discount to our live and recorded webinars.  Members also have access to compliance and billing support.

Join Today 

Find Us


Powered by Wild Apricot Membership Software