HHS Steps Up HIPAA Enforcement After Ransomware Incident at Medical Management Firm
Summary
HHS’s first HIPAA settlement linked to a ransomware incident required Doctors’ Management Services to pay $100,000 and adopt a corrective action plan. HHS also pledged to seek more resources and higher penalties for HIPAA violations.
Key points
- HHS investigated Doctors’ Management Services after a 2019 breach report indicated ransomware had infiltrated its network server and exposed ePHI to unauthorized access.
- HHS found inadequate system monitoring and missing policies and procedures required by the HIPAA Security Rule.
- The company agreed to pay $100,000 and carry out a corrective action plan.
- HHS said it would work with Congress to increase civil monetary penalties and resources for investigating violations and conducting audits.
- The article describes phishing and software vulnerabilities as common ransomware entry points in healthcare and notes that attacks can disrupt patient services and put patient safety at risk.
- The article cites a report that nearly six in ten healthcare organizations were hit by ransomware in the previous year; it also says the Change Healthcare attack reportedly affected billing and care authorization portals.
Article Details
- Event Type
- HHS cybersecurity guidance and HIPAA enforcement response to ransomware affecting healthcare organizations
- Impact
- Ransomware attacks have disrupted healthcare operations, affected billing and care authorization, caused prescription backlogs and revenue losses, and threatened patient care and sensitive medical data. HHS's first HIPAA settlement linked to a ransomware incident required Doctors’ Management Services to pay $100,000 and implement a corrective action plan. HHS also stated it would seek increased penalties and resources for investigations and audits.
People
John RiggiAmerican Hospital Association cybersecurity and risk advisor who said ransomware poses a major concern for healthcare because of its impact on patient safety.Rick PollackAmerican Hospital Association President and CEO who described the Change Healthcare ransomware attack as the most serious incident of its kind against a U.S. healthcare organization.