Health Law Daily Wrap Up, ELECTRONIC HEALTH RECORDS—SETTLEMENT AGREEMENTS: HHS OCR Settles With Provider in HIPAA Security Rule Case, (Oct 2, 2024)

By Tony Foley

The Office of Civil Rights (OCR) for the U.S. Department of Health and Human Services (HHS) said last week that it has settled with a privately-owned health care provider from Washington state regarding violations of the HIPAA Security Rule in connection with a ransomware attack.

According to a September 26 press release announcing the settlement, OCR said that it initiated an investigation against Cascade Eye and Skin Centers, P.C., following a complaint alleging that the provider had suffered a ransomware attack. The office’s investigation found that approximately 291,000 files containing electronic personal health information ePHI) were affected by the attack. OCR found multiple violations of the Security Rule, including a failure to conduct a compliant risk analysis to determine potential risks and vulnerabilities to ePHI in its systems, and insufficient monitoring of its health information systems’ activity to protect against a cyberattack.

Under the resolution agreement and corrective action plan between the parties, Cascade paid $250,000 to OCR and agreed to implement a plan that requires the provider to take a variety of steps to protect and secure the security of ePHI in its possession, including:

1. Conducting an accurate and complete risk analysis;

2. Implement a risk management plan;

3. Develop a review plan for information system activity;

4. Develop emergency response procedures;

5. Develop written procedures for assigning a unique name or number for identifying and tracking user identity in its systems containing ePHI; and

6. Review and revising written policies and procedures to comply with the Security Rile.

The news release also makes general recommendations regarding steps that health care providers, health plans, clearinghouses, and business associates covered by the Security Rule can make to mitigate or prevent cyberthreats, including reviewing vendor relationships, integrating risk analysis and management into business processes, regular reviews of system activities, multifactor authentication, and encryption, among others.

“Cybercriminals continue to target the heath care sector with ransomware attacks. Health care entities that do not thoroughly assess the risks to electronic protected health information and regularly review the activity within their electronic health record system leave themselves vulnerable to attack, and expose their patients to unnecessary risks of harm,” said OCR Director Melanie Fontes Rainer. “Ensuring the confidentiality of electronic protected health information is critical to protect health information privacy and integral to our national security in the health care sector. OCR urges all health care entities to take the essential precautions and stay vigilant to safeguard their systems from cyberattacks.”

CIAsSettlementAgreements: SettlementAgreementsNews EHRNews HITNews HIPAANews ProgramIntegrityNews