AG James Gives Health Care Provider’s Data Security a Checkup Following Ransomware Attack

Cozen O'Connor
Contact
LinkedIn
Facebook
X
Send
Embed

Cozen O'Connor

  • New York AG Letitia James settled with Refuah Health Center, Inc. to resolve allegations the health care provider violated the HIPAA Security Rule and Breach Notification Rule, as well as New York’s General Business Law, by employing poor data security that allowed cyberattackers to access the personal and private information of approximately 250,000 New Yorkers.
  • According to AG James, bad actors were allegedly able to execute a ransomware attack against the company in May 2021 in part by utilizing administrative credentials that had not been changed for at least 11 years. Refuah also allegedly failed to adopt other appropriate data security practices that could have prevented or minimized the attack.
  • Under the terms of the settlement, Refuah must maintain a comprehensive Information Security Program designed to protect the confidentiality of consumer information, maintain policies and procedures to appropriately limit access to consumer personal information, and develop a comprehensive incident response plan, among other things. These investments will cost Refuah an approximated $1.2 million, and Refuah will also pay $450,000 to the state in penalties and costs.
Send Print Report

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Cozen O'Connor | Attorney Advertising

Written by:

Cozen O'Connor
Cozen O'Connor
Contact
more
less

Cozen O'Connor on:

Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
Sign Up Log in
*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
- hide
- hide