Healthcare Data Security

Emergency Directives Issued by CISA and OCR to Mitigate Critical Windows Vulnerabilities

Microsoft has issued patches for several critical vulnerabilities in all supported Windows versions that require urgent attention to prevent exploitation. While there have been no reports of exploitation of the flaws in the wild, the seriousness of the vulnerabilities and their potential to be weaponized has prompted both the Department of Homeland Security (DHS) and the Department of Health and Human Services (HHS) to issue emergency directives about the vulnerabilities.

One of the vulnerabilities was discovered by the National Security Agency (NSA), which took the unusual step of reporting the vulnerability to Microsoft. This is the first time that a vulnerability has been reported by the NSA to a software vendor.

Windows CryptoAPI Vulnerability Requires Immediate Patching

The NSA-discovered vulnerability, tracked as CVE-2020-0601, affects Windows 10 and Server 2016/2019 systems. The vulnerability is due to how the Windows CryptoAPI validates Elliptic Curve Cryptography (ECC) certificates. The flaw would allow a remote attacker to sign malicious code with an ECC certificate to make it appear that the code has been signed by a trusted organization.

The vulnerability could also be exploited in a man-in-the-middle attack. Malicious certificates could be issued for a hostname that did not authorize it and applications and browsers that rely on the Windows’ CryptoAPI would not issue any warnings or alerts. A remote attacker could exploit the flaw and decrypt, modify, or inject data on user connections undetected.

There are no reported cases of exploitation of the vulnerability, but the NSA believes it will not take long for advanced persistent threat (APT) groups to understand the underlying flaw and weaponize the vulnerability, hence the decision to report the flaw to Microsoft.

According to the NSA, “The consequences of not patching the vulnerability are severe and widespread. Remote exploitation tools will likely be made quickly and widely available. Rapid adoption of the patch is the only known mitigation at this time and should be the primary focus for all network owners.”

Critical RCE Vulnerabilities in Windows Remote Desktop

Three pre-authentication vulnerabilities in Windows Remote Desktop have been patched by Microsoft. Two of the vulnerabilities – CVE-2020-0609 and CVE-2020-0610 – could allow a remote attacker to connect to servers and remotely execute arbitrary code without any user interaction. After exploiting the flaws they could install programs, view, change, or delete data, or create new accounts with full admin rights. The flaws could be exploited by sending a specially crafted request to a vulnerable server.

The third vulnerability – CVE-2020-0612 – could be exploited in a similar fashion and could allow an attacker to perform a denial of service attack and crash the RDP system.

The vulnerabilities are present in the RDP Gateway Server and Windows Remote Desktop Client and affect all supported versions of Windows and Windows Server.

Emergency Directives Issued by DHS and OCR

The Department of Homeland Security has determined the vulnerabilities to pose an unacceptable risk to the Federal enterprise and has issued an emergency directive (20-02) to all federal agencies calling for the patches to be applied on all affected endpoints within 10 business days and for technical and/or management controls to be put in place for newly provisioned or previously disconnected endpoints.

The seriousness of the vulnerabilities has prompted the HHS’ Office for Civil Rights to issue an emergency directive of its own to the healthcare industry and public sector. All healthcare and public health entities have been advised to apply the patches as soon as possible to ensure the vulnerabilities are not exploited.

The post Emergency Directives Issued by CISA and OCR to Mitigate Critical Windows Vulnerabilities appeared first on HIPAA Journal.

DHS Warns of Continuing Cyberattacks Exploiting Pulse Secure VPN Vulnerability

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning to Pulse Secure customers urging them to patch the 2019 Pulse Secure VPN vulnerability, CVE-2019-11510.

Pulse Secure VPN servers that have not been patched are continuing to be attacked by cybercriminals. The threat actors behind Sodinokibi (REvil) ransomware are targeting unpatched Pulse Secure VPN servers and are exploiting CVE-2019-11510 to install ransomware. Several attacks have been reported in January 2020. In addition to encrypting data, the attackers are stealing and threatening to publish victims’ sensitive information. Last week data belonging to Artech Information Systems was published when the ransom was not paid.

CISA continues to see widespread exploitation of the flaw by multiple threat actors, including nation-state sponsored advanced persistent threat actors, who are exploiting the flaw to steal passwords, data, and deploy malware.

Exploitation of the vulnerability can allow a remote, unauthenticated attacker to gain access to all active VPN users and obtain their plain-text passwords. According to CISA, an attacker may also be able to execute arbitrary code on VPN clients when they successfully connect to an unpatched Pulse Secure VPN server.

Pulse Secure issued an advisory about the vulnerability on April 24, 2019 and patches were released to fix the flaw on all affected Pulse Connect Secure and Pulse Policy Secure versions, yet many organizations have been slow to apply the patches. Since there are no mitigations or workarounds that can be implemented to prevent exploitation of the vulnerability, the only solution is to apply the patches released by Pulse Secure.

CISA has urged all organizations to apply the patches as soon as possible to prevent exploitation of the vulnerability. It has been estimated that around 10% of Pulse Secure customers have not yet applied the patch and are vulnerable to attack.

The post DHS Warns of Continuing Cyberattacks Exploiting Pulse Secure VPN Vulnerability appeared first on HIPAA Journal.

Support for Windows 7 Finally Comes to an End

Microsoft is stopping free support for Windows 7, Windows Server 2008, and Windows Server 2008 R2 on January 14, 2020, meaning no more patches will be released to fix vulnerabilities in the operating systems. Support for Office 2010 has also come to an end.

The operating systems will be up to date as of January 14, 2020 and all known vulnerabilities will have been fixed, but it will only be a matter of time before exploitable vulnerabilities are discovered and used by cybercriminals to steal data and deploy malware.

Even though Microsoft has given a long notice period that the operating system was reaching end of life, it is still the second most used operating system behind Windows 10. According to NetMarketShare, 33% of all laptop and desktop computers were running Windows 7 in December 2019.

Many healthcare organizations are still using Windows 7 on at least some devices. The continued use of those devices after support is stopped places them at risk of cyberattacks and violating the HIPAA Security Rule.

The natural solution is to update Windows 7 to Windows 10, although that may not be straightforward. In addition to purchasing licenses and upgrading the operating system, hardware may also have to be upgraded and some applications may not work on newer operating systems. The upgrade is therefore likely to be a major undertaking that may take a great deal of time.

If upgrading Windows 7 devices and Windows 2008 servers is not possible, steps should be taken to protect the devices and reduce the likelihood of a compromise and the impact of a cyberattack.

Steps to take to reduce the likelihood of a compromise include preventing the Windows 7 devices from accessing untrusted content. That means not using the devices for accessing email and browsing the internet and portable storage devices and removable media should not be used.

Local administrator rights should be removed from all Windows 7 devices and firewall protection should be strengthened. The devices should not be used for accessing sensitive data, such as protected health information and any sensitive data stored on the devices should be moved to devices running supported operating systems.

Since there is a greater chance of a malware infection on devices running unsupported operating systems, it is essential for anti-virus software to be installed and for it to be kept up to date. Regular scans should be conducted on the devices for malware and the devices should be monitored for potential cyberattacks in progress.

Microsegmentation can help to limit the harm caused in the event of a compromise. All devices running unsupported operating systems should be isolated from other networks and the devices should only be allowed to access critical services. Access to core servers and systems should be removed. It is also strongly advisable to review and revise business continuity plans to ensure that in the event of a compromise, critical business operations can continue. While it is costly to pay for extended support it is strongly recommended.

These measures can reduce risk, but they will not eliminate it. Organizations should therefore be accelerating their plans to upgrade their operating systems and hardware. Moving to a supported operating system is the only way to ensure devices remain secure.

The post Support for Windows 7 Finally Comes to an End appeared first on HIPAA Journal.

DHS Warns of Critical Citrix Vulnerability Being Exploited in the Wild

The Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about a recently discovered vulnerability in the Citrix Application Delivery Controller and Citrix Gateway web server appliances.

Exploitation of the vulnerability – tracked as CVE-2019-19781 – is possible over the internet and can allow remote execution of arbitrary code on vulnerable appliances. Exploitation of the flaw would allow a threat actor to gain access to the appliances and attack other resources connected to the internal network. Some security researchers have described the bug as one of the most dangerous to be discovered in recent years.

The alert, issued on January 8, 2019, urges all organizations using the affected Citrix appliances (formerly NetScaler ADC and NetScaler Gateway) to apply mitigations immediately to limit the potential for an attack, and to apply the firmware updates as soon as they are released later this month.

Two proof of concept exploits have already been published on GitHub which makes exploitation of the flaws trivial. Scans for vulnerable systems have increased since the publication of the exploits on Friday by Project Zero India and TrustedSec and attacks on honeypots setup by security researchers have increased in frequency over the weekend.

Worldwide there are approximately 80,000 companies in 158 countries that need to apply mitigations to correct the vulnerabilities. Approximately 38% of vulnerable organizations are located in the United States.

The flaws are present in all supported versions of the Citrix Application Delivery Controller and Citrix Gateway web server – versions 13.0, 12.1, 12.0, 11.1, and 10.5 – which include Citrix NetScaler ADC and NetScaler Gateway.

The path traversal bug was discovered by UK security researcher Mikhail Klyuchnikov who reported it to Citrix. The flaw can be exploited over the internet on a vulnerable appliance without the need for authentication. All that is required to exploit the flaw is to find a vulnerable appliance and send a specially crafted request along with the exploit code.   The bug is being referred to as Shitrix by security researchers on cybersecurity forums.

Currently there is no patch available to correct the flaw. Citrix will be issuing a firmware upgrade later this month to correct the vulnerability, which is currently scheduled for release on January 20, 2020 for firmware versions 11.1 and 12.0, January 27, 2020 for versions 12.1 and 13.0, and January 31, 2020 for version 10.5.

In the meantime, it is essential for configuration changes to be applied to make it harder for the vulnerability to be exploited. These can be found on Citrix Support Page CTX267679.

Since the flaw is currently under active attack, after applying mitigations it is important to check to make sure the flaw has not already been exploited.

TrustedSec, which held back on publishing its PoC exploit code until an exploit had already been released on GitHub, has developed a tool that can be used to identify vulnerable Citrix instances on networks and has published potential indicators of compromised Citrix hosts.

The post DHS Warns of Critical Citrix Vulnerability Being Exploited in the Wild appeared first on HIPAA Journal.

Healthcare Data Breaches Predicted to Cost Industry $4 Billion in 2020

Healthcare industry data breaches are occurring more frequently than ever before. The healthcare data breach figures for 2019 have yet to be finalized, but so far 494 data breaches of more than 500 records have been reported to the HHS’ Office for Civil Rights and more than 41.11 million records were exposed, stolen, or impermissibly disclosed in 2019. That makes 2019 the worst ever year for healthcare data breaches and the second worst in terms of the number of breached healthcare records.

The healthcare industry now accounts for around four out of every five data breaches and 2020 looks set to be another record-breaking year. The cost to the healthcare industry from those breaches is expected to reach $4 billion in 2020.

The poor state of healthcare cybersecurity was highlighted by a survey of healthcare security professionals conducted in late 2019 by Black Book Market Research. The survey was conducted on 2,876 security professionals from 733 provider organizations to identify cybersecurity gaps, vulnerabilities, and deficiencies in the healthcare industry.

The survey revealed more than 93% of healthcare organizations experienced a data breach between Q3, 2016. 57% of surveyed healthcare providers experienced more than 5 breaches in that period. Even though there is a high risk of a data breach being suffered, investment in cybersecurity is nowhere near the level it needs to be.

“It is becoming increasingly difficult for hospitals to find the dollars to invest in an area that does not produce revenue,” said Doug Brown, founder of Black Book. According to 90% of hospital representatives surveyed, IT security budgets have remained level since 2016.”

The survey revealed hospital systems have increased their cybersecurity budgets to around 6% of their IT spend but spending on cybersecurity by physician organizations has decreased since 2018 and now stands at less than 1% of their IT budget.

When money is spent on cybersecurity, solutions are often purchased blindly or with little vision or discernment. The survey showed that between 2016 and 2018, 92% of data security purchase decisions were made by the C-suite without any users or affected department managers being involved in the purchasing decision.

Despite the threat of attack, 92% of healthcare organizations lack full time cybersecurity professionals and only 21% of hospitals said they had a dedicated security executive. Only 6% of those respondents said that individual was the Chief Information Security Officer (CISO). Physician groups are much less likely to have a CISO. Only 1.5% of physician groups with more than 10 clinicians said they had a dedicated CISO.

More CISOs and cybersecurity professionals are sorely needed, but it is unclear where those individuals will come from due to a nationwide shortage of skilled cybersecurity professionals. In the meantime, cybersecurity is having to be outsourced to managed service providers as a stop-gap measure.

Other key findings of the survey include:

  • 96% of IT professionals said threat actors are outpacing medical enterprises
  • More money is being spent on marketing to repair damaged reputations after a breach than is spent on combating the consequences of data breaches.
  • 35% of healthcare organizations did not scan for vulnerabilities before an attack
  • 87% of healthcare organizations have not had a cybersecurity drill with an incident response process
  • 40% of providers surveyed do not carry out measurable assessments of their cybersecurity status.
  • 26% of hospital respondents and 93% of physician organizations currently report they do not have an adequate solution to instantly detect and respond to an organizational attack.

The post Healthcare Data Breaches Predicted to Cost Industry $4 Billion in 2020 appeared first on HIPAA Journal.

FBI Issues Alert as Maze Ransomware Attacks Increase in the U.S.

Last week, the Federal Bureau of Investigation (FBI) issued a flash alert warning private companies in the United States about the threat of attacks involving Maze ransomware. The warning came just a few days after the FBI issued an alert about two other ransomware variants, LockerGoga and MegaCortex.

The Maze ransomware TLP: Green warning is not intended for public distribution as it provides technical details about the attacks and indicators of compromise which can be used by private firms to prevent attacks. If published in the public domain, it could aid the attackers.

In the alert, victims of Maze ransomware attacks were urged to share information with the FBI as soon as possible to help its agents trace the attackers and bring them to justice.

Maze ransomware was first identified in early 2019, but it was not until November 2019 when the first attacks hit companies in the United States. Those attacks have been increasing in recent weeks.

When network access is gained, data is exfiltrated prior to file encryption. A ransom demand is then issued specific to the organization. The attackers claim they will supply the keys to decrypt files and will destroy all data they stole in the attack. The attackers warn their victims that if payment is not made before the deadline is reached, they will start publishing the stolen data.

Maze ransomware was used in a recent attack on the City of Pensacola. When the ransom was not paid the attackers started publishing the stolen data. In December, the Carrollton, GA-based wire and cabling firm, Southwire, was attacked with Maze ransomware. An 850 BTC ($6 million) ransom demand was issued for the keys to decrypt files. The attackers said they had stolen data and threatened to publish it if the ransom was not paid. When no payment was received, the attackers created a website with an Irish ISP and started publishing the data.

Southwire successfully obtained a court injunction in Ireland forcing the ISP to take down the website that was being used by the Maze gang to publish its data. That website is now offline. Southwire also filed a lawsuit against the hackers in federal court in Georgia. Southwire alleges violations of the U.S. Computer Fraud and Abuse Act and is seeking injunctive relief and damages. Since the attackers are unknown, the lawsuit was filed against ‘John Doe.’

According to CyberScoop, which obtained a copy of the FBI alert, the threat actors use a variety of methods to attack businesses, including malicious cryptocurrency websites, malspam and phishing campaigns impersonating government agencies and security vendors, and ransomware downloads via exploit kits such as Fallout.

The FBI has urged private companies in the United States to heed its warning and take steps to strengthen their defenses and address vulnerabilities. In the event of an attack, the FBI does not recommend paying the ransom as there is no guarantee that valid keys to decrypt data will be supplied or that the stolen data will be destroyed.

The post FBI Issues Alert as Maze Ransomware Attacks Increase in the U.S. appeared first on HIPAA Journal.

DHS Warns of Retaliatory Cyberattacks in Response to U.S. Drone Strike

The U.S. Department of Homeland Security has issued a warning about retaliatory cyberattacks following the military action in Iraq in which Iran’s top general, Major General Qasem Soleimani, was killed in a done strike.

The U.S. Department of Defense issued a statement saying “General Soleimani was actively developing plans to attack American diplomats and service members in Iraq and throughout the region.” President Trump tweeted soon after the attack saying, “We took action last night to stop a war. We did not take action to start a war.”

Iran has condemned the attack and the country’s supreme leader, Ayatollah Ali Khamenei, has vowed to take “forceful revenge” on the United States. The U.S. State Department has advised all Americans in Iraq to leave the country over concerns for their safety and on Sunday, Iraqi MPs voted to expel all US troops from the country,

There are genuine fears of reprisal attacks from Iran and growing concern that those attacks will take place in cyberspace rather than on the ground. US companies, government agencies, and critical infrastructure could be targeted. Iran may have relatively limited military power, but highly destructive cyberattacks are well within Iran’s capabilities.

Threat actors with links to the Iranian government have long been conducting cyberattacks in the United States, but the nature of the attacks may well change. Iran has been developing a range of offensive cyber tools and has conducted destructive cyberattacks in the past. Notably, threat actors linked to Iran used the wiper malware Shamoon to attack the Saudi Arabian oil giant Aramco in 2012. Further wiper malware variants are understood to have also been developed which could be deployed against targets in the United States. Iran has also been linked to the SamSam ransomware attacks, including the attack on the City of Atlanta.

Acting secretary of the DHS, Chad Wolf, said no specific, credible threats against the United States have been identified so far. The DHS will continue to monitor the situation and will be working with local, state, and federal partners to ensure the safety of all Americans.

It is not known if or when any attacks will take place, but local, state, and federal leaders have been urged to take the necessary precautions. Director of the DHS’ Cybersecurity and Infrastructure Security Agency, Chris Krebs, said on Twitter, “Bottom line: time to brush up on Iranian [Tactics, Techniques and Procedures] and pay close attention to your critical systems, particularly ICS. Make sure you’re also watching third party accesses!”

Krebs also referenced an earlier warning that he issued in June, in which he said, “CISA is aware of a recent rise in malicious cyber activity directed at United States industries and government agencies by Iranian regime actors and proxies. We will continue to work with our intelligence community and cybersecurity partners to monitor Iranian cyber activity, share information, and take steps to keep America and our allies safe.”

The post DHS Warns of Retaliatory Cyberattacks in Response to U.S. Drone Strike appeared first on HIPAA Journal.

Hospital Employee Pleads Guilty to Five-Year Account Hacking Spree

The U.S. Department of Justice (DOJ) has announced that a former employee of a New York City hospital has pleaded guilty to using malicious software to obtain the credentials of coworkers, which he subsequently misused to steal sensitive information.

Richard Liriano, 33, of the Bronx, New York, was IT worker at the unnamed NYC hospital. As an IT worker, Liriano had administrative-level access to computer systems. He misused those access rights to steal information, which he copied onto his own computer for personal use.

He used a keylogger to obtain the credentials of dozens of co-workers at the hospital between 2013 and 2018. Those credentials allowed Liriano to login to coworkers’ computers and online accounts and obtain sensitive information such as tax documents, personal photographs, videos, and other private documents and files. Other malicious software was also used to spy on his coworkers.

Liriano stole credentials to coworkers’ personal webmail accounts, social media accounts, and other online accounts. Liriano also gained access to hospital computers containing sensitive patient information. According to the DOJ, Liriano’s computer intrusions cost his employer around $350,000 to remediate.

Between 2013 and 2018, Liriano accessed coworkers’ computers and personal accounts on multiple occasions looking for sensitive information. The majority of his 70+ victims were female. The DOJ reports that Liriano conducted searches of their personal accounts looking for sexually explicit photos and videos.

The computer intrusions were discovered and Liriano was arrested on November 14, 2019. On December 20, 2019, Liriano pleded guilty to one count of transmitting a program to a protected computer to intentionally cause damage.

“Liriano’s disturbing crimes not only invaded the privacy of his coworkers; he also intruded into computers housing vital healthcare and patient information, costing his former employer hundreds of thousands of dollars to remediate,” said  Geoffrey S. Berman, the United States Attorney for the Southern District of New York. “He will now be held accountable for his actions.”

Liriano faces a maximum jail term of 10 years and has been scheduled to be sentenced on April 15, 2020 by U.S. District Judge Lewis A. Kaplan.

The post Hospital Employee Pleads Guilty to Five-Year Account Hacking Spree appeared first on HIPAA Journal.

HIPAA Enforcement in 2019

It has been another year of heavy enforcement of HIPAA compliance. HIPAA enforcement in 2019 by the Department of Health and Human Services’ Office for Civil Right (OCR) has resulted in 10 financial penalties. $12,274,000 has been paid to OCR in 2019 to resolve HIPAA violation cases.

2019 saw one civil monetary penalty issued and settlements were reached with 9 entities, one fewer than 2018. In 2019, the average financial penalty was $1,022,833.

HIPAA Enforcement in 2019 by the HHS' Office for Civil Rights

 

Particularly egregious violations will attract financial penalties, but some of the HIPAA settlements in 2019 provide insights into OCRs preferred method of dealing with noncompliance. Even when HIPAA violations are discovered, OCR prefers to settle cases through voluntary compliance and by providing technical assistance. When technical assistance is provided and covered entities fail to act on OCR’s advice, financial penalties are likely to be issued.

This was made clear in two of the most recent HIPAA enforcement actions. OCR launched compliance investigations into two covered entities after being notified about data breaches. OCR discovered in both cases that HIPAA Rules had been violated. OCR chose to provide technical assistance to both entities rather than issue financial penalties, but the covered entities failed to act on the guidance and a financial penalty was imposed.

Sentara Hospitals disagreed with the guidance provided by OCR and refused to update its breach report to reflect the actual number of patients affected. West Georgia Ambulance was issued with technical guidance and failed to take sufficient steps to address the areas of noncompliance identified by OCR.

If you are told by OCR that your interpretation of HIPAA is incorrect, or are otherwise issued with technical guidance, it pays to act on that guidance quickly. Refusing to take corrective action is a sure-fire way to guarantee a financial penalty, attract negative publicity, and still be required to change policies and procedures in line with the guidance.

There were two important HIPAA enforcement updates in 2019. OCR adopted a new interpretation of the Health Information Technology for Economic and Clinical Health (HITECH) Act’s requirements for HIPAA penalties and a new enforcement initiative was launched.

The HITECH Act of 2009 called for an increase in the penalties for HIPAA violations. On January 25, 2013, the HHS implemented an interim final rule and adopted a new penalty structure. At the time it was thought that there were inconsistencies in the language of the HITECH Act with respect to the penalty amounts. OCR determined that the most logical reading of the HITECH Act requirements was to apply the same maximum penalty of $1,500,000 per violation category, per calendar year to all four penalty tiers.

In April 2019, OCR issued a notice of enforcement discretion regarding the penalties. A review of the language of the HITECH Act led to a reduction in the maximum penalties in three of the four tiers. The maximum penalties for HIPAA violations were changed to $25,000, $100,000, and $250,000 for penalty tiers, 1, 2, and 3. (subject to inflationary increases).

2019 saw the launch of a new HIPAA Right of Access enforcement initiative targeting organizations who were overcharging patients for copies of their medical records and were not providing copies of medical records in a timely manner in the format requested by the patient.

The extent of noncompliance was highlighted by a study conducted by Citizen Health, which found that 51% of healthcare organizations were not fully compliant with the HIPAA Right of Access. Delays providing copies of medical records, refusals to send patients’ PHI to their nominated representatives or their chosen health apps, not providing a copy of medical records in an electronic format, and overcharging for copies of health records are all common HIPAA Right of Access failures.

The two HIPAA Right of Action settlements reached so far under OCR’s enforcement initiative have both resulted in $85,000 fines. With these enforcement actions OCR is sending a clear message to healthcare providers that noncompliance with the HIPAA Right of Access will not be tolerated.

Right of Access violations aside, the same areas of noncompliance continue to attract financial penalties, especially the failure to conduct a comprehensive, organization-wide risk analysis. 2019 also saw an increase in the number of cited violations of the HIPAA Breach Notification Rule.

HIPAA Compliance Issues Cited in 2019 Enforcement Actions

Noncompliance Issue Number of Cases
Risk Analysis 5
Breach Notifications 3
Access Controls 2
Business Associate Agreements 2
HIPAA Right of Access 2
Security Rule Policies and Procedures 2
Device and Media Controls 1
Failure to Respond to a Security Incident 1
Information System Activity Monitoring 1
No Encryption 1
Notices of Privacy Practices 1
Privacy Rule Policies and Procedures 1
Risk Management 1
Security Awareness Training for Employees 1
Social Media Disclosures 1

OCR’s HIPAA enforcement in 2019 also clearly demonstrated that a data breach does not have occurred for a compliance investigation to be launched. OCR investigates all breaches of 500 or more records to determine whether noncompliance contributed to the cause of a breach, but complaints can also result in an investigation and compliance review. That was the case with both enforcement actions under the HIPAA Right of Access initiative.

 

The post HIPAA Enforcement in 2019 appeared first on HIPAA Journal.