Late last year, the Department of Health and Human Services (HHS) issued its first HIPAA settlement agreement involving a ransomware attack.  In the press release announcing the settlement, HHS stated that they began investigating Doctors’ Management Services, a Massachusetts-based medical management company, in April 2019 after receiving a breach notification indicating that its network server had been infected by ransomware. The ransomware attack resulted in unauthorized access to its network which contained Electronic Protected Health Information (ePHI). In their investigation, HHS found evidence of insufficient monitoring of health information systems’ activity, and a lack of policies and procedures in place to implement the requirements of the HIPAA Security Rule. As a result, the company has agreed to pay $100,000 in penalties, and to implement a corrective action plan to resolve potential HIPAA Privacy violations.

Ransomware is a type of malware that attempts to deny access to a user’s data, usually by encrypting the data with a key known only to the hacker, until a ransom is paid. Ransomware continues to be a threat, especially for covered entities. HHS reports that in the past four years, there has been a 239% increase in large breaches reported to the Office of Civil Rights (OCR) involving hacking and a 278% increase in ransomware. In 2023 alone, hacking accounted for 77% of the large breaches reported to OCR. While ransomware may not always lead to a breach, when electronic PHI is encrypted by ransomware, it is considered acquired by an unauthorized individual, and becomes an unauthorized disclosure under the HIPAA Privacy Rule. If an entity is infected with ransomware, the incident is presumed to be a data breach unless it can be demonstrated that a “low probability that the PHI has been compromised.”  If an entity cannot demonstrate a “low probability” the entity must then comply with the applicable breach notification provisions, including notification to affected individuals, to the Secretary of HHS, and to the media (for breaches affecting over 500 individuals) in accordance with HIPAA breach notification requirements.

HHS has made it clear that they will be focused on ransomware attacks going forward.  All covered entities, including health plans that process or store ePHI, must be proactive in protecting their systems from cyberattacks. Plan sponsors should ensure that their security policies are up to date and that their workforce is regularly trained on all security procedures. 

[View source.]