HHS settles 2 ransomware investigations as attacks rise

Dive Transient:

The HHS’ Workplace for Civil Rights has settled two investigations into HIPAA violations following ransomware assaults on suppliers.
Plastic Surgical procedure Associates of South Dakota can pay $500,000 to OCR after the company discovered “a number of potential violations” of the well being privateness and safety rule within the wake of a 2017 ransomware incident that affected greater than 10,000 individuals, in accordance with a press launch final week.
OCR additionally discovered Oklahoma-based Bryan County Ambulance Authority did not conduct a threat evaluation throughout an investigation into an assault reported in 2022 that compromised information from greater than 14,000 sufferers. The emergency companies supplier can pay a $90,000 positive.

Dive Perception:

The newest settlements mark the sixth and seventh ransomware enforcement actions for the OCR. The company settled its first ransomware investigation a few 12 months in the past. 

Federal regulators have elevated their deal with healthcare cybersecurity — and signaled curiosity in mandating extra cyber requirements — within the wake of rising threats.

“Fascinated with that variety of Individuals that will likely be impacted, that variety of cyberattacks which are impacting our healthcare system, it’s the high precedence for my workplace,” OCR Director Melanie Fontes Rainer stated throughout an interview at HLTH final month. 

The investigation into Plastic Surgical procedure Associates of South Dakota discovered the supplier did not conduct an evaluation to seek out dangers to protected well being info. It additionally didn’t put safety measures in place to cut back these vulnerabilities, implement procedures to frequently overview IT system exercise and put in place insurance policies to handle safety incidents, in accordance with OCR. 

The corporate agreed to implement a corrective motion plan, and the company will monitor the supplier for 2 years. Plastic Surgical procedure Associates of South Dakota didn’t reply to a request for remark by press time.

BCAA may even should put a corrective motion plan in place, in accordance with OCR.

The BCAA settlement is OCR’s first linked to an initiative that focuses investigations on compliance with HIPAA’s threat evaluation provision. Underneath the legislation, lined entities are required to conduct an intensive evaluation of the potential dangers and vulnerabilities to the confidentiality and safety of the group’s protected well being info.

In an announcement to Healthcare Dive, the emergency companies supplier stated it was taking efforts to bolster safeguards and introduce extra measures to stop an identical occasion from occurring once more.