WASHINGTON — A substance use disorder treatment center in Illinois has agreed to pay a $103,000 penalty and submit to two years of federal monitoring after a successful phishing attack compromised the private health information of nearly 2,000 patients.

The U.S. Department of Health and Human Services (HHS) announced a settlement this week with Top of the World Ranch Treatment Center (TWRTC) regarding potential violations of the HIPAA Security Rule. The enforcement action is part of a ongoing initiative by the HHS Office for Civil Rights (OCR) to ensure healthcare organizations are properly analyzing their security risks.

The investigation was triggered by a breach report filed by TWRTC in March 2023. The center revealed that an unauthorized third party had gained access to a staff member’s email account through a phishing scheme, compromising the electronic protected health information (ePHI) of 1,980 individuals.

OCR’s investigation concluded that the breach stemmed from a fundamental compliance failure: TWRTC had not conducted an “accurate and thorough risk analysis” to identify potential threats to the patient data it held.

The HIPAA Security Rule requires covered entities—including healthcare providers, health plans, and their business associates—to implement safeguards to protect ePHI. A core requirement of this rule is the Risk Analysis provision, which mandates organizations to regularly assess risks and vulnerabilities to the confidentiality, integrity, and availability of electronic patient data.

“In a time where health care providers and other HIPAA regulated entities are facing unprecedented cybersecurity threats, compliance with the HIPAA Risk Analysis provision is more essential than ever,” said OCR Director Paula M. Stannard. “Covered entities and business associates cannot protect electronic protected health information if they haven’t identified potential risks and vulnerabilities to that health information.”

Terms of the Settlement

Beyond the $103,000 financial penalty, TWRTC has entered into a resolution agreement that requires it to implement a robust corrective action plan (CAP) overseen by OCR for the next two years. Under the CAP, the center must:

  • Conduct a Comprehensive Risk Analysis: Perform an accurate and thorough assessment of potential risks and vulnerabilities to its ePHI.

  • Develop a Risk Management Plan: Create and implement a formal plan to address and mitigate the security risks identified in the analysis.

  • Update Policies and Procedures: Revise and maintain written policies to ensure compliance with the HIPAA Privacy, Security, and Breach Notification Rules.

  • Provide Mandatory Staff Training: Ensure all workforce members with access to ePHI receive annual training on the center’s updated HIPAA policies.

OCR Recommendations for Healthcare Entities

In light of the settlement, OCR is urging all HIPAA-covered organizations to take proactive steps to prevent similar incidents, including:

  • Mapping Data: Identifying exactly where ePHI resides within the organization and how it moves through information systems.

  • Regular Risk Assessments: Periodically conducting and updating risk analyses and implementing management measures to address identified vulnerabilities.

  • Implementing Audit Controls: Ensuring systems are in place to record and examine information system activity.

  • Reviewing System Activity: Regularly monitoring information system logs for suspicious behavior.

  • Authenticating Users: Utilizing strong mechanisms to verify the identity of users seeking access to ePHI.

  • Encrypting Data: Encrypting ePHI both while it is being transmitted and while it is stored to guard against unauthorized access.

  • Learning from Incidents: Incorporating lessons learned from past security incidents into the overall security management process.

  • Ongoing Training: Providing workforce members with regular, role-specific HIPAA training.

The resolution agreement and full corrective action plan are available on the HHS website.