HHS OCR Settles Ransomware Cybersecurity Investigation for $250,000

On September 26, 2024, the U.S. Department of Health and Human Services, Office for Civil Rights ("HHS OCR") announced that it had settled its cybersecurity investigation with Cascade Eye and Skin Centers, P.C. ("Cascade"), a privately-owned health care provider in Washington. For background, HHS OCR is responsible for administering and enforcing the Health Insurance Portability and Accountability Act of 1996, as amended, and its implementing regulations, which include the HIPAA Privacy, Security, and Breach Notification Rules (collectively, "HIPAA"). Among other things, HIPAA requires that regulated entities take steps to protect the privacy and security of patients' protected health information ("PHI").

HHS OCR initiated an investigation concerning potential violations of HIPAA after receiving a complaint alleging that Cascade experienced a ransomware attack. The investigation determined that approximately 291,000 files containing electronic PHI ("ePHI") were affected. The investigation also found multiple potential violations of the HIPAA Security Rule, including failure by Cascade to conduct a compliant risk analysis to determine the potential risks and vulnerabilities to ePHI in its system and failure to sufficiently monitor its health information systems' activity.

Under the terms of the settlement, Cascade paid $250,000 to HHS OCR and must implement a corrective action plan to require Cascade to take steps to ensure the security of ePHI. For example, among other obligations, the corrective action plan requires that Cascade conduct a risk analysis to determine the potential vulnerabilities to its ePHI and implement a risk management plan to address and mitigate identified vulnerabilities.

As part of the settlement announcement, HHS OCR stated that ransomware and hacking are the "primary cyber-threats in health care," and that since 2018, there has been a 264% increase in large breaches reported to HHS OCR involving ransomware attacks. When speaking about the settlement, HHS OCR director Melanie Fontes Rainer stated that "OCR urges all health care entities to take the essential precautions and stay vigilant to safeguard their systems from cyberattacks."

In the settlement announcement, HHS OCR provided the following recommendations for all health care providers, health plans, clearinghouses, and business associates that are covered by HIPAA to mitigate or prevent cyberthreats:

• Review all vendor and contractor relationships to ensure business associate agreements are in place as appropriate and address breach/security incident obligations.
• Integrate risk analysis and risk management into business processes and are conducted regularly and when new technologies and business operations are planned.
• Ensure audit controls are in place to record and examine information system activity.
• Implement regular review of information system activity.
• Utilize multi-factor authentication to ensure only authorized users are accessing ePHI.
• Encrypt ePHI to guard against unauthorized access to ePHI.
• Incorporate lessons learned from incidents into the overall security management process.
• Provide training specific to organization and job responsibilities and on regular basis; reinforce workforce members' critical role in protecting privacy and security.