By Art Gross, President and CEO, HIPAA Secure Now!
LinkedIn: Art Gross
X: @HIPAASecureNow
Read other articles by this author
In a watershed moment for the healthcare industry, the U.S. Department of Health and Human Services’ (HHS) Office for Civil Rights (OCR), recently finalized a $100,000 settlement with Doctors’ Management Services, a Massachusetts-based medical management company. This historic agreement, the first of its kind for OCR, comes in response to a ransomware attack that exposed the electronic protected health information (ePHI) of over 200,000 individuals, underscoring the escalating threat of ransomware in the healthcare sector.
The Ransomware Landscape in Healthcare
Ransomware, a malicious software designed to deny access to data until a ransom is paid, has become a prevalent cyber threat in healthcare. OCR’s settlement emphasizes the urgent need for covered entities and business associates to fortify their cybersecurity defenses, especially as healthcare continues to be a prime target for such attacks.
Breaking Down the Settlement
Doctors’ Management Services reported the breach to HHS in April 2019, revealing that their network server had fallen victim to the notorious GandCrab ransomware. The attack, affecting over 206,000 individuals, initially occurred on April 1, 2017, with the intrusion going undetected until December 24, 2018. The subsequent investigation by OCR found potential failures in risk analysis, insufficient monitoring of health information systems, and a lack of policies to comply with the HIPAA Security Rule.
Key Takeaways and Industry Implications
Heightened Cybersecurity Awareness
OCR’s settlement coincided with Cybersecurity Awareness Month, serving as a poignant reminder for the healthcare sector to prioritize proactive cybersecurity measures. Ransomware and hacking are identified as primary cyber threats in healthcare, with a notable increase in incidents over the past four years.
Rising Trends
OCR’s data reveals a 239% increase in large breaches involving hacking and a staggering 278% increase in ransomware incidents in the last four years. In 2023, hacking remains the predominant method in large breaches reported to OCR, constituting 77% of incidents.
OCR’s Call to Action
OCR Director, Melanie Fontes Rainer, emphasizes the commonality and targeting of ransomware attacks on the healthcare system. The settlement reinforces the critical need for healthcare organizations to proactively identify and address cybersecurity vulnerabilities continually.
The Corrective Action Plan
In addition to the $100,000 settlement, Doctors’ Management Services has committed to a three-year monitoring period by OCR. The corrective action plan includes a comprehensive review and update of risk analysis, an overhaul of the enterprise-wide risk management plan, policy revisions to comply with Privacy and Security Rules, workforce training, and more.
Best Practices for Mitigating Ransomware Threats
OCR recommends several best practices for covered entities and business associates to mitigate or prevent cyber threats:
- Ensure robust business associate agreements with vendors and contractors.
- Integrate risk analysis and management into regular business processes.
- Implement audit controls to record and review information system activity.
- Enforce multi-factor authentication and encryption for ePHI protection.
- Regularly review and update information system activities and incorporate lessons learned from incidents into overall security management.
A Call to Strengthen Cyber Resilience
The OCR settlement is a pivotal moment for the healthcare industry, signaling the urgent need for heightened cybersecurity measures. As healthcare organizations navigate the evolving landscape of cyber threats, a commitment to ongoing risk assessments, robust security protocols, and a culture of cybersecurity awareness is paramount. Stay tuned for more insights from HIPAA Secure Now as we continue to champion the cause of securing patient data in an ever-changing digital landscape.
This article was originally published on HIPAA Secure Now! and is republished here with permission.
Don’t miss our State of Cybersecurity in Healthcare Virtual Summit 2024
When: Tuesday, January 23, 2024
Time: 12:00 – 4:00 pm ET
Register for this event.
