HHS’ Office for Civil Rights Settles Second Ever Ransomware Cyber-Attack

The U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR), announced a settlement under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) with Green Ridge Behavioral Health, LLC, a Maryland-based practice that provides psychiatric evaluations, medication management, and psychotherapy. OCR enforces the HIPAA Privacy, Security, and Breach Notification Rules, which sets forth the requirements that HIPAA covered entities (most health care providers, health plans, and health care clearinghouses) and their business associates must follow to protect the privacy and security of protected health information. The settlement resolves an investigation following a ransomware attack that affected the protected health information of more than 14,000 individuals. Ransomware is a type of malware (malicious software) designed to deny access to a user’s data, usually by encrypting the data with a key known only to the hacker who deployed the malware, until a ransom is paid. This marks the second settlement that OCR has reached with a HIPAA regulated entity for potential violations identified during an investigation following a ransomware attack.

“Ransomware is growing to be one of the most common cyber-attacks and leaves patients extremely vulnerable,” said OCR Director Melanie Fontes Rainer. “These attacks cause distress for patients who will not have access to their medical records, therefore they may not be able to make the most accurate decisions concerning their health and well-being. Health care providers need to understand the seriousness of these attacks and must have practices in place to ensure patients’ protected health information is not subjected to cyber-attacks such as ransomware.”

In February 2019, Green Ridge Behavioral Health filed a breach report with OCR stating that its network server had been infected with ransomware resulting in the encryption of company files and the electronic health records of all patients. OCR’s investigation found evidence of potential violations of the HIPAA Privacy and Security Rules leading up to and at the time of the breach. Other findings included that Green Ridge Behavioral Health failed to:

• Have in place an accurate and through analysis to determine the potential risks and vulnerabilities to electronic protected health information;
• Implement security measures to reduce risks and vulnerabilities to a reasonable and appropriate level; and
• Have sufficient monitoring of its health information systems’ activity to protect against a cyber-attack.

Under the terms of the settlement, Green Ridge Behavioral Health agreed to pay $40,000 and implement a corrective action plan that will be monitored by OCR for three years. The plan identifies steps that Green Ridge Behavioral Health will take to resolve potential violations of the HIPAA Privacy and Security Rules and to protect electronic protected health information, including:

• Conducting a comprehensive and thorough analysis of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information;
• Designing a Risk Management Plan to address and mitigate security risks and vulnerabilities found in the Risk Analysis;
• Reviewing, and as necessary, developing, or revising its written policies and procedures to comply with the HIPAA Rules;
• Providing workforce training on HIPAA policies and procedures;
• Conducting an audit of all third-party arrangements to ensure appropriate business associate agreements are in place, where applicable; and
• Reporting to OCR when workforce members fail to comply with HIPAA.

***

Ransomware and hacking are the primary cyber-threats in health care. Over the past five years, there has been a 256% increase in large breaches reported to OCR involving hacking and a 264% increase in ransomware. In 2023, hacking accounted for 79% of the large breaches reported to OCR. The large breaches reported in 2023 affected over 134 million individuals, a 141% increase from 2022.

OCR recommends health care providers, health plans, clearinghouses, and business associates that are covered by HIPAA take the following best practices to mitigate or prevent cyber-threats:

• Reviewing all vendor and contractor relationships to ensure business associate agreements are in place as appropriate and address breach/security incident obligations.
• Integrating risk analysis and risk management into business processes; and ensuring that they are conducted regularly, especially when new technologies and business operations are planned.
• Ensuring audit controls are in place to record and examine information system activity.
• Implementing regular review of information system activity.
• Utilizing multi-factor authentication to ensure only authorized users are accessing protected health information.
• Encrypting protected health information to guard against unauthorized access.
• Incorporating lessons learned from previous incidents into the overall security management process.  
• Providing training specific to organization and job responsibilities and on regular basis; and reinforcing workforce members’ critical role in protecting privacy and security.

The resolution agreement and corrective action plan may be found at: https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/green-ridge-behavioral-health-ra-cap/index.html

The HHS Breach Portal: Notice to the Secretary of HHS Breach of Unsecured Protected Health Information may be found at: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf

If you believe that your or another person’s health information privacy or civil rights have been violated, you can file a complaint with OCR at https://www.hhs.gov/ocr/complaints/index.html

HHS has developed guidance to help covered entities and business associates better understand and respond to the threat of ransomware. The fact sheet may be found here: https://www.hhs.gov/sites/default/files/RansomwareFactSheet.pdf?language=es – PDF