OCR Settles Second Investigation Related to Ransomware

The U.S. Department of Health and Human Services’ Office for Civil Rights (OCR) has resolved an investigation following a ransomware attack that affected the protected health information of more than 14,000 people. OCR noted that this marks the second settlement it has reached with a HIPAA-regulated entity for potential violations identified during an investigation of a ransomware attack.

The agreement is with Green Ridge Behavioral Health LLC, a Maryland-based practice that provides psychiatric evaluations, medication management and psychotherapy.

In February 2019, Green Ridge Behavioral Health filed a breach report with OCR stating that its network server had been infected with ransomware, resulting in the encryption of company files and all patients’ electronic medical records. . The OCR investigation found evidence of potential violations of the HIPAA Privacy and Security Rules before and at the time of the breach.

Other findings included that Green Ridge Behavioral Health failed to:
• Have an accurate and comprehensive analysis to determine the potential risks and vulnerabilities of electronic protected health information;
• Implement security measures to reduce risks and vulnerabilities to a reasonable and appropriate level; and
• Have sufficient monitoring of the activity of your health information systems to protect against a cyber attack.

Under the terms of the settlement, Green Ridge Behavioral Health agreed to pay $40,000 and implement a corrective action plan that will be monitored by OCR for three years. The plan identifies the steps Green Ridge Behavioral Health will take to resolve potential violations of the HIPAA Privacy and Security Rules and to protect electronic protected health information, including:
• Conduct a comprehensive and thorough analysis of potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information;
• Design a Risk Management Plan to address and mitigate security risks and vulnerabilities found in the Risk Analysis;
• Review and, as necessary, develop or revise your written policies and procedures to comply with HIPAA Rules;
• Provide workforce training on HIPAA policies and procedures;
• Conduct an audit of all third party agreements to ensure appropriate business partner agreements are in place, where applicable; and
• Report to OCR when workforce members are not HIPAA compliant.

“Ransomware is becoming one of the most common cyberattacks and leaves patients extremely vulnerable,” OCR Director Melanie Fontes Rainer said in a statement. “These attacks cause distress to patients who will not have access to their medical records and therefore may not be able to make the most accurate decisions about their health and well-being. “Healthcare providers must understand the severity of these attacks and must implement practices to ensure that patients’ protected health information is not subject to cyberattacks such as ransomware.”

Over the past five years, there has been a 256 percent increase in major breaches reported to OCR involving hacking and a 264 percent increase in ransomware. In 2023, piracy accounted for 79 percent of major breaches reported to OCR. Major breaches reported in 2023 affected more than 134 million people, an increase of 141 percent from 2022.

We will be happy to hear your thoughts

Leave a reply

Register New Account
Compare items
  • Total (0)
Shopping cart