HIPAA Compliance News

Settlement Agreed with Florida Children’s Health Insurance Website Contractor to Resolve False Claims Act Allegations

Posted by HIPAA Journal

The United States Department of Justice has agreed to settle alleged False Claims Act violations with Jelly Bean Communications Design LLC and manager Jeremy Spinks related to the failure to protect HIPAA-covered data.

Jelly Bean Communications Design is a Tallahassee, FL-based company co-owned by Jeremy Spinks, who is the company’s manager and sole employee. The company provides web hosting functions and services for its clients, one of which was the Florida Healthy Kids Corporation (FHKC). FHKC is a state-created entity that offers health and dental insurance to children in Florida between the ages of 5 and 18. FHKC receives Medicaid funds and state funds for providing health insurance programs for children in Florida.

On July 1, 2012, the Agency for Health Care Administration (AHCA) in Florida contracted with FHKC to provide services for the State Children’s Health Insurance Plan (SCHIP) Program, which included implementing technical safeguards to ensure the confidentiality, integrity, and availability of the electronic protected health information that was received, maintained, or transmitted on behalf of AHCA. FHKC contracted with Jelly Bean Communications Design on October 13, 2013, to provide web design, programming, and hosting services. Under that contract, Jelly Bean Communications Design was required to provide a fully functioning hosting environment that complied with the standards of the HIPAA Security Rule, thus requiring Jelly Bean Communications Design to create appropriate code to ensure the secure communication of HIPAA-protected data. The contract was renewed by FHKC through 2020, with the federal government covering 86% of the payments to Jelly Bean Communications Design.

Between 2013 and 2020, the online application system created by Jelly Bean Communications Design collected data from parents and other individuals that were provided when submitting applications for Medicaid insurance coverage for children. Jelly Bean Communications Design issued invoices to FHKC for its services, which included “HIPAA-compliant hosting” and a monthly retainer fee for hosting and other tasks.

In early December 2020, it became clear that the website had been hacked and unauthorized individuals accessed the application data of more than 500,000 individuals submitted through the HealthyKids.org website. FHKC initiated an investigation that revealed hackers had altered applications allowing data to be stolen. The review of the website found multiple outdated and vulnerable applications and the website had not been patched since November 2013. Further, the website did not maintain audit logs showing who had accessed the personal information of applicants. The types of information compromised included names, dates of birth, email addresses, telephone numbers, addresses, Social Security numbers, financial information, family relationship information, and secondary insurance information. The application portal was shut down by FHKC in December 2020 in response to the cybersecurity failures.

The civil litigation alleged that Jelly Bean Communications Design and Jeremy Spinks failed to follow cybersecurity standards resulting in the exposure of sensitive HIPAA-covered data while submitting false claims that data would be safeguarded, while knowingly failing to properly maintain, patch, and update software systems. While Jelly Bean Communications Design acted as a business associate under HIPAA, the action was taken over violations of the False Claims Act under the Department of Justice’s 2021 Civil Cyber-Fraud Initiative. The Civil Cyber-Fraud Initiative utilizes the False Claims Act to pursue cybersecurity-related fraud by government contractors and grant recipients, and was the result of a coordinated effort by the Justice Department’s Civil Division, Commercial Litigation Branch, Fraud Section, and the U.S Attorney’s Office for the Middle District of Florida, with assistance provided by HHS-OIG.

The claims were settled by Jelly Bean Communications Design and Jeremy Spinks, who agreed to pay $293,771 to resolve the allegations, of which $130,565.00 is restitution. The settlement was agreed to avoid the delay, uncertainty, inconvenience, and expense of protracted litigation, with no admission of liability or wrongdoing and no concession by the United States that its claims were not well founded.

“Companies have a fundamental responsibility to protect the personal information of their website users. It is unacceptable for an organization to fail to do the due diligence to keep software applications updated and secure and thereby compromise the data of thousands of children,” said Special Agent in Charge Omar Pérez Aybar of the Department of Health and Human Services, Office of Inspector General (HHS-OIG). “HHS-OIG will continue to work with our federal and state partners to ensure that enrollees can rely on their health care providers to safeguard their personal information.”

The post Settlement Agreed with Florida Children’s Health Insurance Website Contractor to Resolve False Claims Act Allegations appeared first on HIPAA Journal.

HHS Requests Additional $78 Million in Funding for OCR in Fiscal Year 2024

Posted by HIPAA Journal

The Department of Health and Human Services has requested an additional $78 million in federal funding for the Office for Civil Rights (OCR), almost doubling the appropriations OCR currently receives. OCR enforces 55 privacy, security, civil rights, and religious freedoms statutes and its caseload continues to increase, but its budget has remained flat for many years, only increasing in line with inflation. The years of flat budget have seen its resources and staff become increasingly strained.

Ahead of the funding request, the HHS announced that it has restructured OCR to improve efficiency and get more out of its limited resources. The restructuring will help OCR to reduce the current backlog of investigations, but restructuring alone is not enough. “Since FY 2017, OCR has received a 28 percent increase in HIPAA complaints, and a 100 percent increase in HIPAA large breach reports, while OCR’s enforcement staff decreased by 45 percent due to flat budgets and inflationary increases,” explained the HHS in the report. OCR has also seen declining civil monetary collections since 2019 and its caseload in 2024 is expected to be twice that of 2018.

OCR's Funding Crisis

OCR’s Funding Crisis. Source: HHS FY 2024 Budget in Brief

OCR has increased the number of enforcement actions for non-compliance with the HIPAA Rules but despite twice as many penalties being paid in 2022 as in 2018, supplemental funds from its enforcement actions have fallen significantly. In 2022, OCR saw a 92.6% reduction in total penalties compared to 2018 despite a 100% increase in the number of penalties. The reduction in penalty amounts is due to a reexamination of the text of the HITECH Act. The HITECH Act called for an increase in civil monetary penalties for HIPAA violations, but after reexamining the text of HITECH, OCR determined the language had been misinterpreted and reduced the maximum penalty amounts in three of the four penalty tiers.

Since 2019, the majority of civil monetary penalties and settlements have been for violations of the HIPAA Right of Access. These settlements and civil monetary penalties typically resolve cases involving HIPAA violations related to a single patient by small healthcare providers. The penalties agreed to resolve these HIPAA violations total just $2,440,150, with the penalties imposed ranging from $3,500 to $240,000 with an average payment of $56,748 and a median payment of $36,000. These investigations are far less complicated than investigations of cyberattacks, which are much more in-depth and resource intensive.

Declining funds from civil monetary penalties and settlements. Source: HHS FT 2024 Budget in Brief

In 2021 and 2022, there were 36 civil monetary penalties and settlements, with just 5 resolving HIPAA violations other than HIPAA Right of Access failures. Increasing investigations of hacking incidents to determine whether there have been HIPAA Security Rule violations – which often result in multi-million-dollar penalties – is simply not possible with the limited resources at OCR’s disposal. OCR has already had one such penalty overturned by a federal appeals court, which ruled that OCR’s approach was arbitrary, capricious, and contrary to law. Further, OCR will soon also have to share a percentage of the funds it receives from its enforcement activities with individuals who have been harmed by HIPAA violations. That will reduce the supplemental funds OCR receives, and implementing that HITECH Act provision will also take a chunk out of OCR’s budget. It is clear that civil monetary settlement funding is no longer sufficient to address OCR’s budget shortfall.

OCR explained in the report that its 2024 legislative proposals seek an increase in the maximum penalties it can impose for HIPAA violations per calendar year, which will help to increase funding. The proposals also authorize OCR to work with the Department of Justice to strengthen OCR’s enforcement of the HIPAA Rules by obtaining injunctive relief, requiring HIPAA-regulated entities to take steps to prevent additional or further harm to individuals resulting from non-compliance with the HIPAA Rules in the most egregious and urgent cases. Even with the increase in penalty amounts, OCR is still likely to struggle to pursue those cases with its budgetary restrictions.

The $78 million budget increase includes funding for implementing a methodology for sharing funds from enforcement actions with victims of HIPAA violations and $6 million in funding to support enforcement activities related to substance use disorder records, as mandated by the CARES Act. The increase will also help OCR to boost its policy, education, and outreach efforts in non-discrimination areas including race, color, national origin, disability, sex, age, and religion.

While the increase in funding is desperately needed, this is not the first time that the HHS has requested additional funding to support OCR’s increasing caseload. Previous attempts have failed and there is little to suggest this year’s proposal will fare any better.

The post HHS Requests Additional $78 Million in Funding for OCR in Fiscal Year 2024 appeared first on HIPAA Journal.

HHS Announces Restructuring Effort to Trim Backlog of HIPAA and Civil Rights Complaints

Posted by HIPAA Journal

The U.S. Department of Health and Human Services (HHS) has restructured its Office for Civil Rights (OCR) and has created new divisions that will help improve the enforcement of HIPAA and civil rights laws and clear the current backlog of complaints and investigations. OCR is the main law enforcement agency of the HHS and is responsible for enforcing 55 civil rights, conscience, and privacy statutes, including the Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health (HITECH) Act.

In a recent report to Congress, OCR explained that its caseload has increased significantly in recent years, yet appropriations have not risen, which has placed the department under great strain. Reported data breaches increased by 58% between 2017 and 2021, and complaints about potential HIPAA have also been soaring, rising 25% year-over-year to 34,077 complaints in 2021. Complaints about civil rights violations have also increased, rising by 69% between 2017 and 2022. In 2022, 51,000 complaints were received by OCR, 66% for alleged violations of HIPAA, 27% for alleged civil rights violations, and 7% for alleged violations of conscience/religious freedom.

To ensure that complaints can be investigated in a timely manner, the HHS has created three new divisions within OCR – an Enforcement Division, a Policy Division, and a Strategic Planning Division. The enforcement division will be dedicated to investigating HIPAA complaints, with a focus on cybersecurity breaches, which have soared in recent years to over 660 in 2020 and more than 700 in 2022. Approximately 80% of all reported data breaches are due to hacking.

The current Health Information Privacy Division (HIP) will be renamed the Health Information Privacy, Data, and Cybersecurity Division (HIPDC), to better reflect the role it plays in cybersecurity and investigating data breaches related to hacking. OCR will also reorganize the responsibilities of other divisions into new, crosscutting divisions to improve efficiency, with staff in those divisions working in areas of expertise where they have the right skill sets, which it is hoped will drive greater implementation and enforcement of the law. The new divisions will provide a more integrated operational structure for civil rights, conscience protection, and privacy/cybersecurity protections, with the department’s new structure reflecting that of other federal civil rights offices, such as the Office for Civil Rights of the Department for Education.

OCR still desperately needs more funding to allow it to better achieve its objectives; however, the restructuring will allow the department to get better use of its limited resources. OCR has confirmed that the Enforcement Division will be a standalone division that will operate under the direction of Luis Perez, who has spent 4 years as Deputy Director for Conscience and Religious Freedom at OCR. The Enforcement division, under Perez’s leadership, will provide vital integration between OCR’s regional offices and headquarters to ensure complaints can be swiftly investigated.

“This structure will enable OCR staff to leverage its deep expertise and skills to ensure that we are protecting individuals under the range of federal laws that we are tasked with enforcing,” said HHS’ Office of Civil Rights Director, Melanie Fontes Rainer in a statement.

The post HHS Announces Restructuring Effort to Trim Backlog of HIPAA and Civil Rights Complaints appeared first on HIPAA Journal.

January 2023 Healthcare Data Breach Report

Posted by HIPAA Journal

January is usually one of the quietest months of the year for healthcare data breaches and last month was no exception. In January, 40 data breaches of 500 or more records were reported to the HHS’ Office for Civil Rights, the same number as in December 2022. January’s total is well below the 53 data breaches reported in January 2022 and the 12-month average of 58 data breaches a month.

For the second successive month, the number of breached records has fallen, with January seeing just 1,064,195 healthcare records exposed or impermissibly disclosed – The lowest monthly total since June 2020, and well below the 12-month average of 4,209,121 breached records a month.

Largest Healthcare Data Breaches in January 2023

In January there were 13 data breaches involving 10,000 or more records, 8 of which involved hacked network servers and email accounts. The largest data breach of the month affected Mindpath Health, where multiple employee email accounts were compromised. 5 unauthorized access/disclosure incidents were reported that impacted more than 10,000 individuals, three of which were due to the use of tracking technologies on websites. The tracking code collected individually identifiable information – including health information – of website users and transmitted that information to third parties such as Google and Meta, including the month’s second-largest breach at BayCare Clinic. Another notable unauthorized access incident occurred at the mobile pharmacy solution provider, mscripts. Its cloud storage environment had been misconfigured, exposing the data of customers of its pharmacy clients on the Internet for 6 years.

HIPAA-Regulated Entity State Covered Entity Type Individuals Affected Cause of Breach
Community Psychiatry Management, LLC (Mindpath Health) NC Healthcare Provider 193,947 Compromised email accounts
BayCare Clinic, LLP WI Healthcare Provider 134,000 Impermissible disclosure of PHI due to website tracking technology
DPP II, LLC (Home Care Providers of Texas) TX Healthcare Provider 125,981 Ransomware attack (data theft confirmed)
Jefferson County Health Center (Jefferson County Health Department) MO Healthcare Provider 115,940 Hacked network server
UCLA Health CA Healthcare Provider 94,000 Impermissible disclosure of PHI due to website tracking technology
mscripts®, LLC CA Business Associate 66,372 PHI exposed due to misconfigured cloud storage
Circles of Care, Inc. FL Healthcare Provider 61,170 Hacked network server
Howard Memorial Hospital AR Healthcare Provider 53,668 Hacked network server
Stroke Scan Inc TX Healthcare Provider 50,000 Hacking Incident – No public breach announcement
University of Colorado Hospital Authority CO Healthcare Provider 48,879 Hacking incident at business associate (Diligent)
Insulet Corporation MA Healthcare Provider 29,000 Impermissible disclosure of PHI due to website tracking technology
City of Cleveland OH Health Plan 15,206 Unauthorized access/disclosure incident – No public breach announcement
DotHouse Health Incorporated MA Healthcare Provider 10,000 Hacked network server

Causes of January 2023 Healthcare Data Breaches

Just over half of the 40 data breaches reported in January were hacking/IT incidents, the majority of which involved hacked network servers. Ransomware attacks continue to be conducted, although the extent to which ransomware is used is unclear, as many HIPAA-regulated entities do not disclose the exact nature of their hacking incidents, and some entities have not made public announcements at all. Across the 23 hacking incidents, the records of 698,295 individuals were exposed or stolen. The average breach size was 30,61 records and the median breach size was 5,264 records.

There was an increase in unauthorized access/disclosure incidents in January, with 15 incidents reported. The nature of 7 of the unauthorized access/disclosure incidents is unknown at this stage, as announcements have not been made by the affected entities. 5 of the 15 incidents were due to the use of tracking technologies on websites and web apps. Across the 15 unauthorized access/disclosure incidents, 362,629 records were impermissibly accessed or disclosed. The average breach size was 24,175 records and the median breach size was 3,780 records. There were two theft incidents reported, one involving stolen paper records and one involving a stolen portable electronic device. Across those two incidents, 3,271 records were stolen. No loss or improper disposal incidents were reported.

Where Did the Data Breaches Occur?

Healthcare providers were the worst affected HIPAA-covered entity with 31 reported data breaches and 5 data breaches were reported by health plans. While there were only 4 data breaches reported by business associates of HIPAA-covered entities, 14 data breaches had business associate involvement. 10 of those breaches were reported by the covered entity rather than the business associate. The chart below shows the breakdown of data breaches based on where they occurred, rather than which entity reported the breach.

The chart below highlights the impact of data breaches at business associates. 23 data breaches occurred at health plans, involving almost 275,000 records. The 14 data breaches at business associates affected almost three times as many people.

Geographical Spread of January Data Breaches

California was the worst affected state with 7 breaches reported by HIPAA-regulated entities based in the state, followed by Texas with 6 reported breaches. January’s 40 data breaches were spread across 40 U.S. states.

State Breaches
California 7
Texas 6
Georgia, Massachusetts, Missouri & Pennsylvania 3
Florida, New York & North Carolina 2
Alabama, Arkansas, Colorado, Illinois, Indiana, Minnesota, New Jersey, Ohio & Wisconsin 1

HIPAA Enforcement Activity in January 2023

The Office for Civil Rights announced one settlement in January to resolve potential violations of the HIPAA Right of Access. OCR investigated a complaint from a personal representative who had not been provided with a copy of her deceased father’s medical records within the allowed 30 days. It took 7 months for those records to be provided. Life Hope Labs agreed to pay a $16,500 financial penalty and adopt a corrective action plan that will ensure patients are provided with timely access to their medical records in the future. This was the 43rd penalty to be imposed under OCR’s HIPAA Right of Access enforcement initiative, which was launched in the fall of 2019. No HIPAA enforcement actions were announced by state attorneys general in January.

The post January 2023 Healthcare Data Breach Report appeared first on HIPAA Journal.

Biden Administration Considers HIPAA Update to Better Protect Reproductive Health Information

Posted by HIPAA Journal

The Biden Administration is considering new rulemaking to update HIPAA to better protect reproductive health information, following the Supreme Court Decision in Dobbs v. Jackson Women’s Health Organization, which removed the federal right to abortion and left it to individual states to decide on the legality of abortions for state residents. Currently, at least 24 U.S. states have implemented bans on abortions or are likely to do so, with 12 states already having a near-total ban.

The Health Insurance Portability and Accountability Act classes reproductive health information as protected health information (PHI), so uses and disclosures are restricted by the HIPAA Privacy Rule. Following the Supreme Court decision, the HHS issued guidance to HIPAA-regulated entities on how the HIPAA Privacy Rule applies to reproductive healthcare data, confirming uses and disclosures of reproductive health information are restricted, and that the information can only be used or disclosed without a valid patient authorization for purposes related to treatment, payment, or healthcare operations.

The HHS also confirmed that while the HIPAA Privacy Rule permits disclosures of PHI “as required by law,” the HIPAA Privacy Rule does not require such disclosures, and that ‘required by law’ is limited to “a mandate contained in law that compels an entity to make a use or disclosure of PHI and that is enforceable in a court of law,” an that when such a disclosure is required, it is limited to the relevant requirements of such a law. There is concern, however, that disclosures of reproductive health information may be made by HIPAA-regulated entities to law enforcement in states that have imposed bans or severe restrictions on abortions to support enforcement of the bans and allow individuals seeking abortion care to be prosecuted.

There have been calls for HIPAA to be updated to improve privacy protections with respect to reproductive health information. Currently, there are restrictions on disclosures of certain subclasses of PHI such as psychotherapy notes and information related to substance use disorder (SUD) treatment records, and similar restrictions could potentially be applied to reproductive health information. It has now been confirmed that the Department of Health and Human Services has drafted Proposed Modifications to the HIPAA Privacy Rule to Support Reproductive Health Care Privacy (RIN 0945-AA20), and that proposal is currently under White House review. The HHS has also proposed a change to a rule introduced by the Trump Administration that made it easier for healthcare providers to decline to provide abortions due to religious objections.

The HHS has not released details of the proposed HIPAA update at this stage but has confirmed that prior to drafting the rule, the HHS participated in listening sessions and roundtable discussions with patients, healthcare providers, advocates, and state health officials and that the proposed rule was drafted under its statutory mandate to ensure non-discriminatory access to healthcare for all Americans.

The draft is not necessarily an attempt to impose restrictions on states that have introduced near-total bans on abortions and could be an attempt to ensure any actions by states are compliant with Federal law. It is worth noting that even if the HIPAA Privacy Rule is updated to better protect reproductive health data, HIPAA only applies to HIPAA-regulated entities, and no HIPAA update would be able to guarantee privacy for individuals seeking abortion care. For instance, geolocation data from mobile phones would allow individuals to be tracked when they visit reproductive health clinics.  Geolocation data is not protected by HIPAA and disclosure of such information are not restricted by the HIPAA Privacy Rule.

The post Biden Administration Considers HIPAA Update to Better Protect Reproductive Health Information appeared first on HIPAA Journal.

Lack of Funding Hampering OCR’s Ability to Enforce HIPAA

Posted by HIPAA Journal

The HHS’ Office for Civil Rights (OCR) has published a report it sent to Congress that details its HIPAA enforcement activities in 2021, which provides insights into the state of compliance with the HIPAA Privacy, Security, and Breach Notification Rules. The report makes it clear that OCR’s resources are under considerable strain, and without an increase in funding from Congress, OCR will struggle to fulfill its mission to enforce HIPAA compliance, especially considering the large increase in reported data breaches and HIPAA complaints.

OCR reports significant increases in reported data breaches and HIPAA complaints, with large data breaches – 500 or more records – increasing by more than 58% between 2017 and 2021, and HIPAA complaints increasing by 25% between 2020 and 2021, yet between 2017 and 2021, OCR has not had any increases in appropriations, with Congress only increasing funding in line with inflation.

If Congress is unable to increase funding for OCR, the financial strain could be eased through enforcement actions; however, OCR has seen funding through enforcement decline after reassessing the language of the HITECH Act and determining it had been misinterpreted in 2009, resulting in the maximum penalty amounts in three of the four penalty tiers being significantly reduced. To address this and increase funding, OCR sent a request to Congress in September 2021 (HHS FY 2023 Discretionary A-19 Legislative Supplement) calling for an increase in HITECH civil monetary penalty caps), as without such an increase, OCR’s staff and resources will continue to be severely strained, especially during a time of substantial growth in cyberattacks on the healthcare sector.

25% Annual Increase in HIPAA Violation Complaints

There was a sizeable rise in complaints about potential HIPAA and HITECH Act violations in 2021, which increased by 25% year-over-year to 34,077 complaints, 77.5% of which (26,420) were resolved in 2021, 78% of which (20,611 complaints) were resolved without having to initiate an investigation. OCR explained that action can only be taken in response to complaints where the HIPAA violation occurred after the compliance deadline, where the complaint is against a HIPAA-regulated entity, where a HIPAA violation appears to have occurred, and when the complaint is submitted within 180 days of the complainant becoming aware of the violation (unless the complainant shows good cause why the violation was not reported within 180 days).

The most common reasons for closing complaints without an investigation were the complaint was made against a non-HIPAA-regulated entity or allegations were made about conduct that did not violate HIPAA (3%), and due to untimely complaints (1%). OCR said 4,139 complaints were resolved by providing technical assistance in lieu of an investigation, 714 complaints were resolved by the HIPAA-regulated entity taking corrective action, and 789 complaints were resolved through technical assistance taken after an investigation was initiated. There was a 10% year-over-year reduction in initiated compliance investigations, with 1,620 compliance investigations initiated in response to complaints. 50% were resolved as no violation was discovered, 44% were resolved through corrective action, and 6% were resolved through technical assistance after investigation. 13 complaints were resolved through settlements and corrective action plans with penalties totaling $815,150, and 2 were resolved through civil monetary penalties totaling $150,000.

674 compliance reviews were initiated for reasons other than complaints, 609 were initiated in response to large data breaches, 22 due to small data breaches, and a further 43 were initiated in response to incidents brought to OCR’s attention by other means, such as reports in the media. In 2021, OCR closed 573 compliance reviews, resulting in corrective actions or civil monetary penalties in 83% of the investigations. Two compliance reviews resulted in resolution agreements that included $5,125,000 in financial penalties and corrective action plans. The remaining 17% of compliance reviews were resolved through technical assistance (3%), insufficient evidence of HIPAA violations (11%), or where there was a lack of jurisdiction to investigate (3%). OCR said its HIPAA compliance audit program has stalled due to a lack of financial resources.

Click here to view OCR’s Annual Report to Congress on HIPAA Privacy, Security, and Breach Notification Rule Compliance

Click here to view a summary of OCR’s Report on Breaches of Unsecured PHI in 2021

The post Lack of Funding Hampering OCR’s Ability to Enforce HIPAA appeared first on HIPAA Journal.

OCR: HIPAA-Regulated Entities Need Continue to Improve HIPAA Security Rule Compliance

Posted by HIPAA Journal

The Department of Health and Human Services’ Office for Civil Rights (OCR) has publicly released two reports that were submitted to Congress that provide insights into data breaches, HIPAA enforcement activity, and the state of HIPAA Privacy and Security Rule compliance for calendar year 2021.

According to OCR, in calendar year 2021, OCR received 609 reports of large data breaches – data breaches affecting 500 or more individuals – with those incidents affecting 37,182,558 individuals. OCR also received 63,571 reports of data breaches affecting fewer than 500 individuals – which are not publicly reported. 319,215 individuals were affected by those smaller data breaches. That’s 64,180 data breaches in total in 2021 affecting 37,501,772 individuals.

If you follow the breach reports and healthcare data breach statistics reported in the HIPAA Journal, you will notice a discrepancy with OCR’s official figures. That is because the statistics are based on the data breaches reported to OCR via the OCR HIPAA Breach Web Portal, which lists 714 data breaches for calendar year 2021. OCR investigates all of those breaches, but the report to Congress only includes data breaches that occurred in 2021 or continued into 2021. 105 of the data breaches reported to OCR in calendar year 2021 occurred and ended prior to 2021, but were reported in 2021.

OCR investigates all data breaches of 500 or more records and initiates HIPAA compliance reviews in all of those breaches to determine whether noncompliance with the HIPAA Rules was a contributory factor. In 2021, OCR launched investigations into all 609 data breaches plus 22 data breaches involving fewer than 500 individuals. 554 data breach investigations were completed in 2021 due to the investigations being closed with no further action as HIPAA violations were not determined to have occurred, or when HIPAA violations were discovered and were resolved through voluntary compliance, technical assistance, or resolution agreements and corrective action plans.

The adjusted data show there was a 7% annual reduction in data breaches of 500 or more records compared to 2020, and a 4% reduction in smaller data breaches. By comparison, there was a 61% increase in large data breaches in 2020 and a 6% increase in small data breaches. From 2017 to 2021, small data breaches increased by 5.4% and large data breaches increased by 58.2%.

In 2021, hacking/IT incidents accounted for 75% of large data breaches and 95% of the affected individuals, with the breached information most commonly stored on network servers. 19% of breaches and 4% of impacted individuals were affected by unauthorized access/disclosure incidents, 3% of reported breaches involved theft (<1% of affected individuals), 1% involved loss of PHI (<1% of affected individuals), and 1% involved improper disposal of PHI (1% of affected individuals). Unauthorized access/disclosure incidents accounted for the majority of small breaches, with those breaches typically involving paper records.

Healthcare providers reported 72% of the data breaches in 2021 (437 reports and 24,389,630 affected individuals), 15% of the breaches were reported by health plans (93 reports and 3,236,443 affected individuals), 13% by business associates (977 reports and 9,554,023 affected individuals), and <1% by healthcare clearinghouses (2 reports affecting 2,462 individuals).

Largest Data Breaches in 2021 in Each Breach Category

Breach Type Individuals Affected Cause
Hacking/IT Incident 3,253,822 Hacked Network Server
Unauthorized Access/Disclosure 326,417 Software Configuration Error Exposed ePHI
Improper Disposal 122,340 Improper disposal of hard drives containing ePHI
Theft 21,601 Theft of laptops and paper records in burglary
Loss of PHI 14,532 Loss of medical records

Lessons Learned from 2022 Data Breaches

OCR reports that the most common vulnerabilities identified during its investigations were failures to follow HIPAA Security Rule standards and implementation specifications. “There is a continued need for regulated entities to improve compliance with the HIPAA Rules,” explained OCR in the report. “In particular, the Security Rule standards and implementation specifications of risk analysis, risk management, information system activity review, audit controls, and access control were areas identified as needing improvement in 2021 OCR breach investigations.”

The most common remedial actions to breaches of 500 or more records were:

  • Implementing multi-factor authentication for remote access
  • Revising policies and procedures
  • Training or retraining workforce members who handle PHI
  • Providing free credit monitoring and identity theft protection services to customers
  • Adopting encryption technologies
  • Imposing sanctions on workforce members who violated policies and procedures for removing PHI from facilities or who improperly accessed PHI
  • Changing passwords
  • Performing a new risk assessment
  • Revising business associate contracts to include more detailed provisions for the protection of health information

When serious violations of HIPAA are identified and/or corrective action has not been proactively taken in response to data breaches, OCR will impose corrective action plans and financial penalties. In 2021, OCR resolved two investigations of data breaches with resolution agreements and corrective action plans, resulting in settlements totaling $5.1 million. One settlement was reached with Excellus Health Plan, which agreed to pay a financial penalty of $5,100,000 to resolve the HIPAA violations that contributed to its 2015 data breach affecting 9.3 million individuals, and a $25,000 penalty was paid by Peachstate Health Management (dba AEON Clinical Laboratories) to resolve HIPAA Security Rule violations.

“The health care industry is one of the most diverse industries in our economy, and OCR is responsible for enforcing the HIPAA Rules to support greater privacy and security of individuals’ protected health information,” said OCR Director Melanie Fontes Rainer. “We will continue to provide guidance and technical assistance on compliance with the HIPAA Rules, as well as a vigorous enforcement program to address potential HIPAA violations.”

Click here to view OCR’s Annual Report to Congress on Breaches of Unsecured Protected Health Information (PDF)

Click here to view a summary of OCR’s enforcement activity in 2021

The post OCR: HIPAA-Regulated Entities Need Continue to Improve HIPAA Security Rule Compliance appeared first on HIPAA Journal.

What is a HIPAA Security Incident?

Posted by HIPAA Journal

Misunderstandings can sometimes exist with the distinction between a HIPAA security incident and the definition of a HIPAA breach. Although the two events are quite often linked, not all security incidents result in breaches, and not all breaches are attributable to security incidents.

One of the reasons why misunderstandings can exist about the two terms is that their definitions appear in separate areas of the Administrative Simplification Regulations. With regards to a HIPAA security incident, the definition appears in §164.304 of the Security Rule:

“Security incident means the attempted (emphasis added) or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system.”

The definition of a HIPAA breach does not appear until §164.402 of the Breach Notification Rule. This is because breaches are events that can compromise protected health information regardless of the media on which PHI is maintained:

“Breach means the acquisition, access use, or disclosure of protected health information in a manner not permitted under subpart E of this part (the Privacy Rule) which compromises the security or privacy of the protected health information.”

Therefore, the attempted infiltration of an information system does not necessarily have to be successful before the event qualifies as a HIPAA security incident. Similarly, an impermissible verbal disclosure qualifies as a HIPAA breach even though no security incident has occurred.

Is a HIPAA Security Incident a Reportable Event?

Whether or not a HIPAA security incident is a reportable event depends on who experiences the incident and what its outcome is. Both Covered Entities and Business Associates are required to document all security incidents and their outcomes – even if the incident results in no harmful effects (i.e., a pattern of pings from an external source).

Covered Entities are not required to report security incidents unless they result in a breach of unsecured protected health information – in which case it is necessary to notify affected individuals and HHS´ Office for Civil Rights unless there is a low probability protected health information has been compromised. The method for determining probability is explained in this article.

However, under §164.314 of the Security Rule, Business Associates are required to report all security incidents to the Covered Entity they are providing a service for. This requirement must be included in Business Associate Agreements between Covered Entities and Business Associates. Therefore, if a Business Associate fails to report a HIPAA security incident, they are in violation of HIPAA.

Additionally, Covered Entities are required to monitor a Business Associate´s compliance with the Business Associate Agreement. Therefore, if a Covered Entity receives no reports of a HIPAA security incident, and does not ask why, the Covered Entity is in breach of §164.504 of the Privacy Rule for failing to exercise reasonable diligence with regard to who PHI is being disclosed to.

Incident or Breach? Be Sure You Know Which is Which

It is important to know the difference between a HIPAA security incident and a HIPAA breach because these events are clearly defined in the Administrative Simplification Regulations. Therefore, there are no mitigating circumstances for Covered Entities that fail to document security incidents or for Business Associates that fail to report security incidents to their Covered Entities.

While the requirements of the respective Rules can create extra administrative work, the documents produced as a result of the extra work can be used to simplify risk analyses and more easily identify threats. Consequently, complying with the documentation and reporting requirements not only avoids unnecessary violations, but can also help improve an organization´s security posture.

If you are still unsure about the distinction between a HIPAA security incident and a HIPAA breach, you are advised to seek professional compliance advice.

The post What is a HIPAA Security Incident? appeared first on HIPAA Journal.

March 1, 2023: HIPAA Breach Notification Rule Deadline for Reporting Small Data Breaches

Posted by HIPAA Journal

The deadline for reporting healthcare data breaches of fewer than 500 records is fast approaching. HIPAA-regulated entities must ensure these data breaches are reported to the HHS’ Office for Civil Rights (OCR) no later than March 1, 2023. Late reporting of data breaches is a HIPAA violation and can result in a financial penalty.

The HIPAA Breach Notification Rule requires HIPAA-regulated entities to issue notifications to all individuals whose protected health information has been exposed or impermissibly disclosed without unnecessary delay, and no later than 60 days from the discovery of a data breach. HIPAA-regulated entities are also required to report data breaches to the Secretary of the HHS via the OCR breach reporting portal.

The HIPAA Breach Notification Rule requires large data breaches – affecting 500 or more individuals – to be reported to OCR within the same time frame – No later than 60 days from the discovery of the data breach. There is greater flexibility for reporting data breaches affecting fewer than 500 individuals. HIPAA-regulated entities must also report these breaches via the OCR breach reporting portal, but they have 60 calendar days from the end of the year when the breach was discovered to report the data breaches. That means the deadline for reporting these small data breaches is March 1, 2023. It should be stressed that if a HIPAA-regulated entity chooses to take advantage of this Breach Notification Rule flexibility, the extended time frame ONLY applies to breach reporting to OCR. The individuals who had their PHI exposed or impermissibly disclosed must still be notified about the breach within 60 days of when the breach was discovered.

All data breaches must be reported individually through the OCR breach reporting portal. The breach reports must include details of the breach and the efforts made to remediate those incidents. If a HIPAA-regulated entity has experienced multiple small data breaches over the course of a year, that process may take some time. It is therefore best not to wait until the last minute to report the data breaches.

The post March 1, 2023: HIPAA Breach Notification Rule Deadline for Reporting Small Data Breaches appeared first on HIPAA Journal.