Blog

The U.S. Department of Health and Human Services Office for Civil Rights, also known as OCR, has announced four separate HIPAA settlements involving ransomware breaches. Together, these breaches affected more than 427,000 people and exposed unsecured electronic protected health information, also called ePHI. These settlements are an important reminder for healthcare providers, health plans, healthcare clearinghouses, and business associates. Ransomware is not just an information technology problem. It is also a HIPAA compliance problem when patient or member information is placed at risk. Ransomware is a type of malicious software that can lock or encrypt an organization’s data. The attacker then [...]

WASHINGTON — A substance use disorder treatment center in Illinois has agreed to pay a $103,000 penalty and submit to two years of federal monitoring after a successful phishing attack compromised the private health information of nearly 2,000 patients. The U.S. Department of Health and Human Services (HHS) announced a settlement this week with Top of the World Ranch Treatment Center (TWRTC) regarding potential violations of the HIPAA Security Rule. The enforcement action is part of a ongoing initiative by the HHS Office for Civil Rights (OCR) to ensure healthcare organizations are properly analyzing their security risks. The investigation was triggered by [...]

The U.S. Department of Health and Human Services (HHS) has settled with healthcare provider Concentra, Inc. for failing to provide a patient with timely access to their own medical records. An investigation found that after a patient made six requests starting in February 2018, Concentra did not provide the records until March 2019—over a year later. HIPAA law requires providers to fulfill such requests within 30 days. Concentra has agreed to pay $112,500 to resolve the case. This marks the 54th enforcement action under HHS's "Right of Access" initiative, which emphasizes that patients have a fundamental right to access their health [...]