HIPAA Compliance News

Healthcare Workers Violating Patient Privacy by Uploading Sensitive Data to GenAI and Cloud Accounts

Posted by Steve Alder

Research conducted by the cybersecurity company Netskope indicates healthcare workers routinely expose sensitive data such as protected health information (PHI) by using generative AI tools such as ChatGPT and Google Gemini and by uploading data to personal cloud storage services such as Google Drive and OneDrive.

The healthcare industry has fully embraced AI tools, with almost all organizations using AI tools to some degree to improve efficiency. According to data collected by Netskope Threat Labs, 88% of healthcare organizations have integrated cloud-based genAI apps into their operations, 98% use apps that incorporate genAI features, 96% use apps that leverage user data for training, and 43% are experimenting with running genAI infrastructure locally.

As more healthcare organizations incorporate AI tools into their operations and make them available to their workforces, fewer healthcare workers are using personal AI accounts for work purposes; however, 71% of healthcare workers still use personal AI accounts, down from 87% the previous year. If genAI tools are not HIPAA-compliant and the developers will not sign business associate agreements, using those tools with PHI violates HIPAA and puts organizations at risk of regulatory penalties. Further, uploading patient data to genAI tools and cloud storage services without robust safeguards in place can erode patient trust.

“Beyond financial consequences, breaches erode patient trust and damage organizational credibility with vendors and partners,” Ray Canzanese of Netskope said. It is clear that there needs to be greater oversight of the use of AI tools, and a pressing need for authorized tools to be provided to reduce “shadow AI” risks.

According to Netskope, the mishandling of HIPAA-regulated data is the leading security concern in the healthcare sector, and PHI is the most common type of sensitive data uploaded to personal cloud apps, genAI apps, and other unapproved locations. Netskope reports that 81% of all data policy violations were for regulated healthcare data, with the remainder including source code, secrets, and intellectual property.

“Healthcare organizations must balance the benefits of genAI with the implementation of strict data governance policies to mitigate associated risks,” warns Netskope. Netskope recommends the adoption of enterprise-grade genAI applications with robust security features to ensure that sensitive and regulated data is properly protected, along with data loss prevention (DLP) tools for monitoring and controlling access to genAI tools to prevent privacy violations. Netskope says 54% of healthcare organizations now have DLP policies, up from 31% the previous year. The most commonly blocked genAI apps in healthcare are DeepAI, Tactiq, and Scite, with 44%, 40%, and 36% of healthcare organizations blocking these apps with their DLP tools due to privacy risks and there being more secure alternatives.

While genAI tools certainly have a place in healthcare and can help improve efficiency, there are significant security challenges. Netskope warns that healthcare organizations must remain vigilant, implement comprehensive security measures, and enforce data protection policies, as well as incorporate the risks into their cybersecurity awareness training.

The report also warns of the risk of malware infections via cloud apps. Threat actors are increasingly using cloud apps to deploy information stealers and ransomware, with GitHub, OneDrive, Amazon S3, and Google Drive being the most common. Rather than trying to breach networks themselves, threat actors use social engineering to trick healthcare employees into compromising their own systems with first-stage malware payloads, which give threat actors initial access to networks. Netskope recommends inspecting all HTTP and HTTPS traffic for phishing and malware, blocking apps that serve no business purpose or pose a disproportionate risk to the organization, and using remote browser isolation technology when categories of websites need to be visited that pose a higher risk, such as newly registered domains.

The post Healthcare Workers Violating Patient Privacy by Uploading Sensitive Data to GenAI and Cloud Accounts appeared first on The HIPAA Journal.

New York Neurology Practice Pays $25,000 to Resolve Alleged Risk Analysis Violation

Posted by Steve Alder

The HHS’ Office for Civil Rights (OCR) has announced another settlement to resolve an alleged violation of the risk analysis implementation specification of the HIPAA Security Rule. Comprehensive Neurology PC, a small neurology practice in New York City that specializes in diagnosing and treating neurological conditions such as dementia, Parkinson’s disease, epilepsy, and memory loss, has agreed to settle the alleged violation and pay a $25,000 financial penalty.

The alleged HIPAA violation was identified by OCR during an investigation of a 2020 data breach that involved unauthorized access to the electronic protected health information (ePHI) of 6,800 individuals. OCR was informed of the data breach on December 17, 2020. Comprehensive Neurology discovered it had been attacked with ransomware on December 14, 2020, when staff were prevented from accessing patients’ medical records. The forensic investigation confirmed that the ePHI of 6,800 individuals had been exposed and potentially stolen in the attack, including names, clinical information, health insurance information, demographic information, Social Security numbers, driver’s license numbers, and state identification numbers.

OCR’s investigation revealed that Comprehensive Neurology had failed to conduct a comprehensive and accurate risk analysis to identify risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI, as required by 45 C.F.R. §164.308(a)(1)(ii)(A) of the HIPAA Security Rule. Comprehensive Neurology was given an opportunity to settle the alleged HIPAA violation informally and agreed to pay a financial penalty and adopt a corrective action plan. OCR will monitor Comprehensive Neurology for compliance with the corrective action plan for two years.

The corrective action plan requires Comprehensive Neurology to:

  • Conduct a comprehensive, accurate, and organization-wide risk analysis
  • Develop and implement a risk management plan to reduce the identified risks and vulnerabilities to a low and acceptable level
  • Develop, implement, and maintain policies and procedures to ensure compliance with the HIPAA Rules
  • Distribute those policies and procedures to members of the workforce
  • Provide training to the workforce on those policies and procedures
  • Submit an implementation report to OCR and annual reports confirming compliance with the corrective action plan
  • Ensure that any data breaches or compliance violations are reported to OCR promptly

It has been a busy month of HIPAA enforcement for OCR. So far this month, OCR has announced four settlements with HIPAA-regulated entities to resolve alleged violations of the HIPAA Rules, and seven penalties this year under the Trump administration. All seven of the enforcement actions include penalties for risk analysis failures.  The settlement with Comprehensive Neurology was OCR’s 12th investigation of a ransomware attack to result in a financial penalty for HIPAA compliance failures, and the 8th enforcement action under OCR’s risk analysis enforcement initiative. OCR explained that by focusing on risk analyses, the most commonly identified HIPAA violation, OCR can increase the number of closed investigations and highlight the importance of compliance with this foundational HIPAA Security Rule requirement.

“Effective cybersecurity requires proactively implementing the HIPAA Security Rule requirements before a breach or cybersecurity incident occurs,” said OCR Acting Director Anthony Archeval. “OCR urges health care entities to prioritize compliance with the HIPAA Security Rule risk analysis requirement.”

HIPAA violation penalties 2020-2025 HIPAA violation penalties 2020-2025

The post New York Neurology Practice Pays $25,000 to Resolve Alleged Risk Analysis Violation appeared first on The HIPAA Journal.

OCR Explains Department’s Key Priorities at HHS-NIST Conference

Posted by Steve Alder

Last week, the Department of Health and Human Services (HHS) and the National Institute for Standards and Technology (NIST) hosted the Safeguarding Health Information: Building Assurance Through HIPAA Security 2024 conference after a 5-year absence. Attendees learned about the current cybersecurity landscape in healthcare, how compliance with the HIPAA Security Rule can help HIPAA-regulated entities combat cyber threats, and were provided with practical tips and techniques for implementing the requirements of the HIPAA Security Rule.

On October 24, 2024, in a keynote speech, OCR Director Melanie Fontes Rainer provided an update on OCR’s main priorities. One of the key priorities is an update to the HIPAA Security Rule to add new cybersecurity requirements. OCR has been working on an update to the HIPAA Security Rule this year and has now finalized its proposed rule. The proposed rule is now being reviewed by the Office of Management and Budget (OMB) and Fontes Rainer anticipates publishing a Notice of Proposed Rulemaking (NPRM) before the end of the year.

Fontes Rainer did not share any of the cybersecurity measures that have been added, only confirming that since this will be the first time in two decades that the HIPAA Security Rule has been updated, there will be “substantive updates.” The process of rulemaking has been informed by thousands of investigations of healthcare data breaches and complaints, which has allowed OCR to develop a more robust HIPAA Security Rule to make sure the healthcare sector is much more secure. When the NPRM is published, likely to be in December 2024, healthcare industry stakeholders will be able to submit their feedback and have their say. Fontes Rainer said the department is looking forward to the opportunity to engage with the healthcare community through the public commenting process.

Fontes Rainer explained that OCR has continued to investigate complaints and data breaches and has imposed several financial penalties this year to resolve noncompliance issues. This year, as well as its enforcement actions over the past 15 years, have uncovered the same noncompliance issues time and time again. One of the most commonly identified issues, and one of the main areas of noncompliance to result in financial penalties, is noncompliance with the risk analysis provision of the HIPAA Security Rule. In many investigations, OCR has discovered the failure to conduct a comprehensive, organization-wide risk analysis to identify risks and vulnerabilities to ePHI, incomplete risk analyses, and compliance with that requirement but a failure to act on the information gathered during the risk analysis and manage and reduce risks to a low and acceptable level. The importance of compliance with this issue is why OCR has made the risk analysis requirement an enforcement initiative.

OCR has received many complaints in recent years about the failure to provide individuals with a copy of their requested records, as required by the HIPAA Right of Access. It is one of the most common reasons for individuals filing complaints with OCR. In response, OCR launched a HIPAA Right of Access enforcement initiative in 2019 and in the years since has imposed 50 financial penalties for the failure to provide timely access to medical records.

Investigations of complaints and data breaches will remain a key priority for the department but financial penalties are relatively rare. The majority of investigations where noncompliance is discovered are resolved through technical assistance, highlighting how OCR works with HIPAA-regulated entities to help them comply with the regulations. Fontes Rainer said the reason compliance issues are flagged is because compliance is important and must be addressed.

The other main focus of OCR is to engage with the healthcare sector on cybersecurity matters but Fontes Rainer said the department is fairly small, has an extensive workload, and limited budget, so OCR’s efforts to engage with the community need to be highly focused and strategic. She said it is vital that OCR and the healthcare community work together to drive forward compliance and improve cybersecurity. OCR has increased engagement through webinars, YouTube videos, and newsletters in an effort to reach more members of the community and combat the growing threat of cyberattacks and data breaches – which affected more than 160 million individuals last year.

The post OCR Explains Department’s Key Priorities at HHS-NIST Conference appeared first on The HIPAA Journal.

Heritage Valley Health System Pays $950,000 to Settle Alleged HIPAA Security Rule Violations

Posted by Steve Alder

The HHS’ Office for Civil Rights (OCR) has agreed to settle alleged HIPAA Security Rule violations with Heritage Valley Health System for $950,000. Heritage Valley is a 3-hospital health system with more than 50 physician offices and many community satellite facilities in Pennsylvania, eastern Ohio, and the panhandle of West Virginia.

In 2017, Heritage Valley was affected by a global malware attack that saw NotPetya malware installed on its network via a connection with its business associate, Nuance Communications. OCR launched an investigation of Heritage Valley in October 2017 following media reports of a data security incident to determine whether Heritage Valley was compliant with the requirements of the HIPAA Security Rule.

OCR’s investigation uncovered multiple Security Rule compliance failures, including the most commonly identified Security Rule issue – The failure to conduct an accurate and thorough risk analysis to identify potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information (ePHI), as required by 45 C.F.R. § 164.308(a)(1)(ii)(A).

The HIPAA Security Rule – 45 C.F.R. § 164.308(a)(7) – requires covered entities to develop and implement a contingency plan for responding to an emergency that damages systems containing ePHI. Heritage Valley was found not to be compliant with this requirement. OCR also identified a failure to implement technical policies and procedures for electronic information systems that maintain ePHI only to permit access by authorized persons or software programs – 45 C.F.R. § 164.308(a)(4) and 164.312(a)(1)).

The healthcare industry is being targeted by ransomware groups and ransomware-related data breaches have increased by 264% since 2018. Healthcare organizations that are fully compliant with the HIPAA Security Rule can reduce the risk of a ransomware attack succeeding and can limit the harm caused in the event of a successful attack.

In addition to paying the financial penalty, Heritage Valley has agreed to implement a corrective action plan, compliance with which will be monitored by OCR for 3 years. The corrective action plan includes the requirement to conduct an accurate and thorough risk analysis, implement a risk management plan to reduce identified risks and vulnerabilities and review, develop, maintain, and revise as necessary its written policies and procedures to comply with the HIPAA Rules and provide training to the workforce on those policies and procedures.

“Hacking and ransomware are the most common type of cyberattacks within the health care sector. Failure to implement the HIPAA Security Rule requirements leaves health care entities vulnerable and makes them attractive targets to cyber criminals,” said OCR Director Melanie Fontes Rainer. “Safeguarding patient-protected health information protects privacy and ensures continuity of care, which is our top priority. We remind and urge health care entities to protect their records systems and patients from cyberattacks.”

This is the third OCR HIPAA penalty imposed in response to a ransomware attack and the fifth HIPAA enforcement action of 2024 to result in a financial penalty.

Total HIPAA enforcement funds paid to OCR

When announcing the enforcement action, OCR took the opportunity to remind all HIPAA-regulated entities of their responsibilities under the HIPAA Security Rule to take action to mitigate or prevent cyber threats. These include:

  • Reviewing relationships with business associates, ensuring a business associate agreement is in place, and addressing data breach and security incident obligations
  • Integrating risk analysis and risk management into business processes, and conducting risk analyses when new technologies are implemented and business operations change.
  • Ensuring an audit trail is maintained and information system activity is regularly reviewed
  • Encrypting ePHI to prevent unauthorized access and implementing multifactor authentication on accounts
  • Providing regular training to the workforce specific to the organization and job responsibilities and reinforcing the role of members of the workforce with respect to privacy and security
  • When security incidents occur, incorporate the lessons learned into the security management process.

The post Heritage Valley Health System Pays $950,000 to Settle Alleged HIPAA Security Rule Violations appeared first on The HIPAA Journal.

March 2024 Healthcare Data Breach Report

Posted by Steve Alder

March was a particularly bad month for healthcare data breaches with 93 branches of 500 or more records reported to the Department of Health and Human Services (HHS) Office for Civil Rights (OCR), a 50% increase from February and a 41% year-over-year increase from March 2023. The last time more than 90 data breaches were reported in a single month was September 2020.

The reason for the exceptionally high number of data breaches was a cyberattack on the rehabilitation and long-term acute care hospital operator Ernest Health. When a health system experiences a breach that affects multiple hospitals, the breach is usually reported as a single breach. In this case, the breach was reported individually for each of the 31 affected hospitals. Had the breach been reported to OCR as a single breach, the month’s breach total would have been 60, well below the average of 66.75 breaches a month over the past 12 months.

Healthcare data breaches in the past 12 months

 

 

healthcare data breaches in March 2020-2024

While the breach total was high, the number of individuals affected by healthcare data breaches fell for the fourth consecutive month to the lowest monthly total since January 2023. Across the 93 reported data breaches, the protected health information of 2,971, 249 individuals was exposed or impermissibly disclosed – the lowest total for March since 2020.

records compromised in healthcare data breaches in the past 12 months

healthcare records breached in march 2020-2024

Biggest Healthcare Data Breaches in March 2024

18 data breaches were reported in March that involved the protected health information of 10,000 or more individuals, all of which were hacking incidents. The largest breach of the month was reported by the Pennsylvanian dental care provider, Risa’s Dental and Braces.  While the breach was reported in March, it occurred 8 months previously in July 2023. A similarly sized breach was reported by Oklahoma’s largest emergency medical care provider, Emergency Medical Services Authority. Hackers gained access to its network in February and stole files containing names, addresses, dates of birth, and Social Security numbers.

Philips Respironics, a provider of respiratory care products, initially reported a hacking-related breach to OCR involving the PHI of 457,152 individuals. Hackers gained access to the network of the Queens, NY-based billing service provider M&D Capital Premier Billing in July 2023, and stole files containing the PHI of 284,326 individuals, an August 2023 hacking incident was reported by Yakima Valley Radiology in Washington that involved the PHI of 235,249 individuals, and the California debt collection firm Designed Receivable Solutions, experienced a breach of the PHI of 129,584 individuals. The details of the breach are not known as there has been no public announcement other than the breach report to OCR.

 Name of Covered Entity State Covered Entity Type Individuals Affected Breach Cause
Risas Dental & Braces PA Healthcare Provider 618,189 Hacking Incident
Emergency Medical Services Authority OK Healthcare Provider 611,743 Hacking Incident
Philips Respironics PA Business Associate 457,152 Exploited software vulnerability (MoveIT Transfer)
M&D Capital Premier Billing LLC NY Business Associate 284,326 Hacking Incident
Yakima Valley Radiology, PC WA Healthcare Provider 235,249 Hacked email account
Designed Receivable Solutions, Inc. CA Business Associate 129,584 Hacking Incident
University of Wisconsin Hospitals and Clinics Authority WI Healthcare Provider 85,902 Compromised email account
Aveanna Healthcare GA Healthcare Provider 65,482 Compromised email account
Ezras Choilim Health Center, Inc. NY Healthcare Provider 59,861 Hacking Incident (data theft confirmed)
Valley Oaks Health IN Healthcare Provider 50,034 Hacking Incident
Family Health Center MI Healthcare Provider 33,240 Ransomware attack
CCM Health MN Healthcare Provider 28,760 Hacking Incident
Weirton Medical Center WV Healthcare Provider 26,793 Hacking Incident
Pembina County Memorial Hospital ND Healthcare Provider 23,811 Hacking Incident (data theft confirmed)
R1 RCM Inc. IL Business Associate 16,121 Hacking Incident (data theft confirmed)
Ethos, also known as Southwest Boston Senior Services MA Business Associate 14,503 Hacking Incident
Pomona Valley Hospital Medical Center CA Healthcare Provider 13,345 Ransomware attack on subcontractor of a vendor
Rancho Family Medical Group, Inc. CA Healthcare Provider 10,480 Cyberattack on business associate (KMJ Health Solutions)

 

Data Breach Causes and Location of Compromised PHI

As has been the case for many months, hacking incidents dominated the breach reports. 76 of the month’s breaches were classed as hacking/IT incidents, which involved the records of 2,918,585 individuals, which is 98.2% of all records compromised in March. The average breach size was 38,402 records and the median breach size was 3,144 records. The nature of the hacking incidents is getting harder to determine as little information about the incidents is typically disclosed in breach notifications, such as whether ransomware or malware was used. The lack of information makes it hard for the individuals affected by the breach to assess the level of risk they face. Many of these breaches were explained as “cyberattacks that caused network disruption” in breach notices, which suggests they were ransomware attacks.

Causes of March 2024 healthcare data breaches

There were 11 unauthorized access/disclosure incidents reported involving a total of 36,533 records. The average breach size was 3,321 records and the median breach size was 1,956 records. There were 4 theft incidents and 1 loss incident, involving a total of 15,631 records (average: 3,126 records; median 3,716 records), and one improper disposal incident involving an estimated 500 records. The most common location for breached PHI was network servers, which is to be expected based on the number of hacking incidents, followed by compromised email accounts.

Location of breached PHI in March 2024 healthcare data breaches

Where Did the Data Breaches Occur?

The OCR data breach portal shows there were 77 data breaches at healthcare providers (2,030,568 records), 10 breaches at business associates (920,522 records), and 6 data breaches at health plans (20,159 records). As OCR recently confirmed in its Q&A for healthcare providers affected by the Change Healthcare ransomware attack, it is the responsibility of the covered entity to report breaches of protected health information when the breach occurs at a business associate; however, the responsibility for issuing notifications can be delegated to the business associate. In some cases, data breaches at business associates are reported by the business associate for some of the affected covered entity clients, with some covered entities deciding to issue notifications themselves. That means that data breaches at business associates are often not abundantly clear on the breach portal. The HIPAA Journal has determined the location of the breaches, with the pie charts below show where the breaches occurred, rather than the entity that reported the breach.

Data breaches at HIPAA-regulated entities in March 2024

Records breached at HIPAA-regulated entities in March 2024

Geographical Distribution of Healthcare Data Breaches

In March, data breaches were reported by HIPAA-regulated entities in 33 U.S. states. Texas was the worst affected state with 16 breaches reported, although 8 of those breaches were reported by Ernest Health hospitals that had data compromised in the same incident. California experienced 10 breaches, including 3 at Ernest Health hospitals, with New York also badly affected with 7 reported breaches.

State Breaches
Texas 16
California 10
New York 7
Pennsylvania 6
Indiana 5
Colorado & Florida 4
Illinois, Ohio & South Carolina 3
Arizona, Idaho, Massachusetts, Michigan, Minnesota, New Mexico, North Carolina, Oklahoma & Utah 2
Alabama, Georgia, Kansas, Kentucky, Nevada, New Jersey, North Dakota, Oregon, Tennessee, Virginia, Washington, West Virginia, Wisconsin & Wyoming 1

HIPAA Enforcement Activity in March 2024

OCR announced one settlement with a HIPAA-regulated entity in March to resolve alleged violations of the HIPAA Rules. The Oklahoma-based nursing care company Phoenix Healthcare was determined to have failed to provide a daughter with a copy of her mother’s records when the daughter was the personal representative of her mother. It took 323 days for the records to be provided, which OCR determined was a clear violation of the HIPAA Right of Access and proposed a financial penalty of $250,000.

Phoenix Healthcare requested a hearing before an Administrative Law Judge, who upheld the violations but reduced the penalty to $75,000. Phoenix Healthcare appealed the penalty and the Departmental Appeals Board affirmed the ALJ’s decision; however, OCR offered Phoenix Healthcare the opportunity to settle the alleged violations for $35,000, provided that Phoenix Healthcare agreed not to challenge the Departmental Appeals Board’s decision.

The post March 2024 Healthcare Data Breach Report appeared first on HIPAA Journal.

New Jersey Nursing Facility to Pay $100,000 CMP to Resolve HIPAA Right of Access Violation

Posted by Steve Alder

The HHS’ Office for Civil Rights has announced another financial penalty has been imposed for a violation of the HIPAA Right of Access. Essex Residential Care, LLC, which does business as Hackensack Meridian Health, West Caldwell Care Center in New Jersey, has been ordered to pay a civil monetary penalty of $100,000 to resolve the alleged violation.

Hackensack Meridian Health operates skilled nursing facilities in New Jersey, including the West Caldwell Care Center. In May 2020, OCR received a complaint from the son of a mother who had received care at West Caldwell Care Center who alleged he had not been provided with a copy of her medical records within the 30 days allowed by the HIPAA Privacy Rule.

Son Not Provided with His Mother’s Records within 30 Days

The complainant was the personal representative of his mother and therefore should have been provided with a copy of his mother’s medical records. The complainant first asked for a copy of the records on April 19, 2020, via email, and on April 23, 2020, an administrator at West Caldwell Care Center advised him that the records could not be provided without a copy of a power of attorney, medical proxy or similar document executed by the mother, confirming that he was her personal representative.

The appropriate documentation was provided but West Caldwell Care Center still did not provide the requested records, which led to him filing a complaint with OCR. On October 15, 2020, OCR notified West Caldwell Care Center that an investigation had been opened as a result of the complaint and the correspondence included a data request pursuant to the investigation.

West Caldwell Care Center responded and acknowledged that the records had not been provided within the allowed 30 days and, in response to OCR’s investigation, sent the requested records in late November, which were received by the complainant on December 1, 2020, 161 days after the initial request was made.

West Caldwell Care Center Disagreed with OCR’s Determination

Most HIPAA Right of Access investigations are informally settled with OCR, a financial penalty is paid, and the covered entity agrees to adopt a corrective action plan which includes updates to its policies and procedures and training on HIPAA policies for staff members. In this case, West Caldwell Care Center’s attorney disagreed with OCR’s proposed resolution of the investigation. OCR then notified West Caldwell Care Center that the investigation had uncovered preliminary indications of non-compliance with the HIPAA Right of Access, and OCR provided West Caldwell Care Center with the opportunity to submit evidence of mitigating factors.

West Caldwell Care Center acknowledged that the complainant was not provided with the requested records, but the records were provided to another facility to which his mother had been transferred. West Caldwell Care Center also said that at the time of the initial request, there was ongoing litigation due to the non-payment of care costs. As another mitigating factor, West Caldwell Care Center said it was dealing with the COVID-19 pandemic, and that the complainant filed a complaint with OCR exactly 30 days after the request was made before West Caldwell Care Center’s response to the initial request was due. West Caldwell Care Center accepted that the matter should have been handled differently.

$100,000 Civil Monetary Penalty Imposed

OCR determined that West Caldwell Care Center failed to provide the requested records within the 30 days allowed by the HIPAA Privacy Rule and that the delay from June 23, 2020, to December 1, 2020, was a violation of the HIPAA Right of Access. The maximum civil monetary penalty was $206,080 based on the reasonable cause penalty tier (see: What are the penalties for HIPAA violations); however, per OCR’s reinterpretation of the language of the HITECH Act and its subsequent Notice of Enforcement Discretion, the penalty was capped at $100,000.

West Caldwell Care Center argued that a civil monetary penalty was not permitted because the violation was not due to wilful neglect and was timely corrected and that imposing a civil monetary penalty would be arbitrary and capricious and would violate the Administrative Procedure Act (APA). OCR disagreed that the violation was timely corrected and said the affirmative defense requirements were not met, and that the penalty was appropriate and reasonable given that the violation did not violate the APA and that the civil penalty amount was reasonable given the substantial delay providing the requested records.

West Caldwell Care Center said its staff believed they had responded in the allowed time frame by transferring the records to another facility; however, OCR’s view was that the records were not provided to the personal representative as required by HIPAA. West Caldwell Care Center was advised of its right to request a hearing with an administrative law judge; but on advice from its legal counsel, chose to waive that right.

“A patient’s timely access to health records is paramount for medical care. The Office for Civil Rights continues to receive complaints from individuals and personal representatives on behalf of individuals who do not receive timely access to their health records,” commented OCR Director Melanie Fontes Rainer. “OCR will continue to vigorously enforce this essential right to ensure compliance by health care facilities across the country.”

This is the fourth financial penalty imposed by OCR in 2024 to resolve alleged HIPAA violations and its 145th financial penalty to date. OCR has now fined 48 HIPAA-regulated entities for failing to provide patients or their personal representatives with timely access to the requested medical records that they are legally entitled to obtain.

The post New Jersey Nursing Facility to Pay $100,000 CMP to Resolve HIPAA Right of Access Violation appeared first on HIPAA Journal.

HHS Issues Guidance to Teaching Hospitals and Medical Schools on Informed Consent Requirements

Posted by Steve Alder

The Department of Health and Human Services (HHS) has written to the nation’s teaching hospitals and medical schools to clarify the requirement to obtain informed consent from patients before they are subjected to sensitive examinations, especially on patients under anesthesia.

HHS Secretary Xavier Becerra, Office for Civil Rights Director Melanie Fontes Rainer, and CMS administrator Chiquita Brooks-LaSure explained in the letter that they are aware of media reports and medical and scientific literature that indicate that as part of the training of medical students, patients are subjected to sensitive and intimate examinations – including pelvic, breast, prostate, or rectal examinations – while under anesthesia, when proper informed consent has not been obtained from the patients.

The letter stresses that it is vital for hospitals and medical schools to obtain and document informed consent before examinations are performed and that informed consent is required in all circumstances. Patients have the right to refuse to have sensitive examinations performed for teaching purposes and can refuse to consent to previously unagreed examinations while under anesthesia. The CMS has issued new guidance that clarifies the requirements of the Hospital Conditions of Participation with respect to the CMS’s revision of its hospital interpretive guidance about informed consent.

OCR has also stressed that under the HIPAA Privacy Rule, patients have the right to restrict who can access their PHI, including in situations where they may be unconscious while having a medical procedure performed. OCR has provided a Q&A that explains this HIPAA Privacy Rule right with respect to examinations by medical students while under anesthesia, and subsequent examinations when the covered entity has agreed to restrict disclosures of PHI.

The post HHS Issues Guidance to Teaching Hospitals and Medical Schools on Informed Consent Requirements appeared first on HIPAA Journal.

Cyber Security for Healthcare: USA Summit

Posted by Ian

The HealthSec: Cyber Security for Healthcare Summit returns for its 2nd edition in Boston, Massachusetts on June 12th – 13th!

As operations in healthcare and life sciences industries are becoming increasingly digitized and internet-connected, the attack surface is expanding and cybersecurity risks are growing.

In the light of this, healthcare security leaders from across the hospitals & healthcare systems, healthcare equipment and services, medical devices, pharma and biotech industries are preparing to gather at the summit to learn how to protect their sensitive data from cyber attacks.

CPD certified event

This CPD certified event is your chance to unite with cybersecurity leaders from the likes of Abbott, GSK, Moderna, Pfizer and Johnson & Johnson through interactive sessions, as well as 6+ hours of networking, including seated lunches and a drinks reception.

Over 2 days, you’ll learn how to build resilience, mitigate risks and strengthen your cybersecurity strategy to combat new and ongoing threats through thought leadership talks, in-depth case-studies, panel discussions and roundtables. See list of speakers

Agenda highlights include:

  • A Culture of Shared Responsibility Between HDOs and MDMs: What It Looks Like, and How to Achieve It
  • How to Effectively Address Third Party Risk Management Pain Points in Healthcare
  • Case Study: Surviving a Ransomware Attack -Lessons Learned from the Healthcare Industry
  • Streamlining Regulatory Compliance in Healthcare: How Do We Get There?

For 15% discount on passes, register now using the code “HIPPA” at registration online here.

The post Cyber Security for Healthcare: USA Summit appeared first on HIPAA Journal.

February 2024 Healthcare Data Breach Report

Posted by Steve Alder

There has been a fall in the number of reported healthcare data breaches for the second consecutive month, with 59 data breaches of 500 or more records reported to the Department of Health and Human Services’ Office for Civil Rights (OCR).

 

There were 10.6% fewer breaches reported in February than in January, which followed a 22% reduction between December 2023 and January 2024. Over the past 12 months, an average of 64 healthcare breaches have been reported each month, and while February is well under that average, 22.9% more breaches were reported in February 2024 than in February 2023.

For the third consecutive month, the number of breached records has fallen, reducing by 41.7% from January to 5,130,515 records, which is well below the 12-month average of 8.9 million records a month and around half as many records as were breached in February 2023. These figures could increase as three data breaches were reported as involving 500 or 501 records. These figures are often placeholders to meet HIPAA’s breach reporting requirements when the number of affected individuals has yet to be determined.

Biggest Healthcare Data Breaches in February 2024

There were 24 data breaches of 10,000 healthcare records in February, the largest of which was a 2.35 million record data breach at Medical Management Resource Group, which does business as American Vision Partners. A further 1.67 million records were compromised in breaches at Eastern Radiologists and Unite Here, both of which were hacking incidents. Only four breaches of 10,000 or more records were not hacking incidents.

Ransomware attacks continue to plague the healthcare industry, but it is difficult to determine the scale of the problem since breach notifications rarely mention whether ransomware was used. Ransomware groups typically steal data and leak it or sell it if the ransom is not paid. If the nature of the attack is not explained to the affected individuals, it is difficult for them to accurately assess the level of risk they face and make informed decisions about the steps they need to take to prevent their personal information from being misused.

Name of Covered Entity State Covered Entity Type Individuals Affected Business Associate Present
Medical Management Resource Group, L.L.C. AZ Business Associate 2,350,236 Hacking incident (Data theft confirmed)
Eastern Radiologists, Inc NC Healthcare Provider 886,746 Hacking incident
UNITE HERE NY Business Associate 791,273 Hacking incident
Northeast Orthopedics and Sports Medicine, PLLC NY Healthcare Provider 177,101 Hacking incident
Bold Quail Holdings, LLC (NewGen Administrative Services, LLC) CA Healthcare Provider 105,425 Hacking incident
Prime Healthcare Employee Health Plan CA Health Plan 101,135 Hacking incident at business associate (Keenan & Associates)
Egyptian Health Department IL Healthcare Provider 100,000 Hacking incident
Scurry County Hospital District dba Cogdell Memorial Hospital TX Healthcare Provider 86,981 Hacking incident
MedQ, Inc. TX Business Associate 54,725 Ransomware attack (Data theft confirmed)
Coleman Professional Services Inc. OH Healthcare Provider 51,889 Email accounts compromised
Greater Cincinnati Behavioral Health Services OH Healthcare Provider 50,000 Hacking incident
Kirkland & Ellis LLP IL Business Associate 48,802 Hacking incident (MOVEit Transfer)
Employee Benefits Corporation of America and Benefit Design Group, Inc. VA Health Plan 38,912 Hacking incident
Washington County Hospital and Nursing Home AL Healthcare Provider 29,346 Ransomware attack (Data theft confirmed)
Qualcomm Incorporated CA Health Plan 27,038 Hacking incident at a business associate
McKenzie County Healthcare System, Inc. ND Healthcare Provider 21,000 Email accounts compromised
East Carolina University’s Brody School of Medicine, a member of the ECU Health affiliated covered entity NC Healthcare Provider 19,085 Unauthorized access to a network server
Tiegerman NY Healthcare Provider 19,000 Hacking incident
Human Affairs International of California CA Business Associate 18,347 Unauthorized Access/Disclosure of paper/films
Maryville, Inc. NJ Healthcare Provider 15,503 Email account compromised
Bay Area Anesthesia, LLC FL Healthcare Provider 15,196 Hacking incident at business associate (Bowden Barlow Law)
AGC Flat Glass North America, Inc. Welfare Benefits Plan GA Health Plan 13,079 Hacking incident
Littleton Regional Healthcare NH Healthcare Provider 12,614 Misdirected email
CVS Caremark Part D Services, L.L.C. (“CVS”) RI Business Associate 11,193 Unauthorized Access/Disclosure of paper/films

Data Breach Causes and Location of Compromised PHI

As has been the case for many months, the main cause of healthcare data breaches in February was hacking. In February, there were 41 data breaches classed as hacking/IT incidents – 69.5% of the month’s data breaches. These incidents typically see large numbers of records compromised and February was no exception. Across those 41 incidents, the protected health information of 5,017,167 individuals was exposed or compromised – 97.8% of the month’s breached records. The 16 largest healthcare data breaches in February were all hacking incidents. The average breach size was 122,370 records and the median breach size was 7,288 records.

HIPAA-regulated entities reported 16 data breaches that were classed as unauthorized access/disclosure incidents. Across those 16 data breaches, the records of 104,359 individuals were accessed by unauthorized individuals or were impermissibly disclosed. The largest of those incidents was a phishing attack that saw multiple email accounts compromised and the records of 21,000 individuals exposed. The average breach size was 6,522 records and the median breach size was 2,516 records. There were two theft incidents involving the records of 8,989 individuals. No loss or improper disposal incidents were reported in February. The most common location of breached healthcare data was network servers, followed by email accounts.

While it is not possible to prevent all data breaches, many could be avoided by ensuring compliance with the HIPAA Security Rule and implementing OCR’s HPH Cybersecurity Performance Goals (CPGs). The CPGs are split into essential CPGs and advanced CPGs. The Essential CPGs address common vulnerabilities, will significantly improve an organization’s security posture and incident response, and minimize residual risk. The Enhanced CPGs are intended to help HPH sector organizations mature their cybersecurity capabilities and improve their defences against additional attack vectors. A recent IBM study determined that 85% of cyberattacks in critical infrastructure sectors could have been prevented with basic security measures such as those included in the essential CPGs.

Where Did the Data Breaches Occur?

OCR’s data breach portal shows there were 33 data breaches at healthcare providers (1,632,712 records), 16 data breaches at health plans (212,785 records), and 10 data breaches at business associates (3,285,018 records). These figures show the reporting entity rather than where the data breach occurred. When a data breach occurs at a business associate, it may be reported by the business associate, the affected covered entities, or a combination of the two. For example, in February,16 data breaches were reported by health plans, but 8 of those breaches occurred at business associates. The pie charts show where the data breaches occurred rather than the entity that reported the breach.

Geographical Distribution of Healthcare Data Breaches

In February, large healthcare data breaches were reported by HIPAA-regulated entities in 27 states and the District of Columbia. California had the most breaches but Arizona was the worst affected in terms of the number of breached records, with 2,351,027 records compromised in 2 data breaches.

State Breaches
California 6
New York & Ohio 5
Illinois, Kentucky & Texas 4
Alabama, Florida & Michigan 3
Arizona, North Carolina & Rhode Island 2
Colorado, Georgia, Iowa, Maryland, Massachusetts, Missouri, New Hampshire, New Jersey, North Dakota, Oklahoma, Pennsylvania, South Carolina, Tennessee, Virginia, West Virginia & the District of Columbia 1

HIPAA Enforcement Activity in February 2024

In February, OCR announced two settlements with HIPAA-regulated entities to resolve HIPAA compliance failures. OCR investigated Montefiore Medical Center, a non-profit hospital system based in New York City, over a data breach involving a malicious insider. The breach was discovered in 2015 by the New York Police Department, and the investigation revealed a former employee had stolen the data of 12,517 patients over a 6-month period in 2013. OCR launched an investigation in 2015, but it took until February 2024 for the case to be settled.

OCR identified multiple HIPAA failures, and the severity of those failures warranted a significant fine. Montefiore Medical Center was determined to have failed to conduct a comprehensive risk analysis, failed to implement procedures to regularly review records of information system activity, and failed to implement hardware, software, and/or procedural mechanisms that record and examine activity in all information systems that contain or use ePHI. Montefiore Medical Center agreed to pay a $4.75 million penalty to settle the alleged HIPAA violations.

OCR also announced a $40,000 settlement with Green Ridge Behavioral Health, a Gaithersburg, MD-based provider of psychiatric evaluations, medication management, and psychotherapy. This was the second settlement to be reached with a HIPAA-regulated entity over a ransomware attack. OCR determined that a comprehensive risk analysis had not been conducted, there was a failure to manage risks to the confidentiality, integrity, and availability of ePHI, and there were insufficient policies and procedures for reviewing records of information system activity. These failures contributed to the ransomware attack and the impermissible disclosure of the PHI of more than 14,000 patients.

State Attorneys General also have the authority to issue financial penalties for HIPAA violations; however, no civil monetary penalties or settlements were announced in February.

The post February 2024 Healthcare Data Breach Report appeared first on HIPAA Journal.