Healthcare Law Blog

FEBRUARY 8, 2023

ICYMI (“in case you missed it”), there is an uptick in enforcement and scrutiny IRL (“in real life”) related to communications through social media and other public platforms by entities subject to the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”).

HIPAA 83

HIPAA Health Insurance Governance Compliance 83

HIPAA Journal

DECEMBER 24, 2022

Penalties for HIPAA violations can be issued by the Department of Health and Human Services’ Office for Civil Rights (OCR) and state attorneys general. In addition to financial penalties, covered entities are required to adopt a corrective action plan to bring policies and procedures up to the standards demanded by HIPAA. .

HIPAA 127

HIPAA Compliance Hospitals COVID-19 127

HIPAA Journal

MAY 29, 2023

It has been 27 years since President Clinton signed the Health Insurance Portability and Accountability Act (HIPAA) into law, but compliance is still proving a challenge for many HIPAA-regulated entities. million in 2022. The average HIPAA penalty has fallen from $2.6 million in 2018 to just $1.6

HIPAA 96

HIPAA Compliance Due Diligence COVID-19 96

HIPAA Journal

NOVEMBER 16, 2022

According to the breach report filed with the Maine Attorney General, it took until October 3, 2022, to confirm that an unauthorized third party had accessed the email system, which included sensitive information of its members. Notification letters were sent to affected individuals on October 31, 2022.

HIPAA 88

HIPAA Licensing Health Insurance Fraud 88

HIPAA Journal

FEBRUARY 10, 2023

Achieving compliance with the Rules of the Health Insurance Portability and Accountability Act (HIPAA) can be a challenge for healthcare organizations and their business associates. One of the biggest challenges for compliance professionals is interpreting the HIPAA Rules and applying those requirements to their organization.

HIPAA 104

HIPAA Compliance Compliance Officers Health Insurance 104

HIPAA Journal

JANUARY 5, 2023

Back in June 2022 , HIPAA Journal reported on a cyberattack on Fitzgibbon Hospital in Marshall, MO, after being contacted directly by a spokesperson for a threat group called DAIXIN Team, who claimed responsibility for the attack. Howard Memorial Hospital Announces December 2022 Cyberattack.

Ransomware 116

Ransomware Hospitals HIPAA Licensing 116

HIPAA Journal

MAY 23, 2023

the 2022 update to the Pennsylvania Breach of Personal Information Notification Act (BPINA) is now in effect. The update broadened the definition of personal information to include medical information, health insurance information, and usernames in combination with a password or security question/answer that allows an account to be accessed.

Health Insurance 83

Health Insurance HIPAA 83

HIPAA Journal

JANUARY 6, 2023

Washington Attorney General Bob Ferguson is suing a plastic surgery provider for falsely inflating online ratings, bribing, and threatening patients, and alleges the actions of the practice violated the Health Insurance Portability and Accountability Act (HIPAA) Rules. The lawsuit was filed in the U.S.

HIPAA 75

HIPAA Health Insurance Compliance 75

Hall Render

DECEMBER 22, 2022

On December 15, 2022, the Office for Civil Rights (“OCR”) at the U.S. Department of Health and Human Services (“HHS”) settled its investigation of a potential Health Insurance Portability and Accountability Act (“HIPAA”) violation by a primary care provider in Florida. Your primary Hall Render contact.

HIPAA 40

HIPAA Compliance Health Insurance 40

HIPAA Journal

JUNE 29, 2022

On June 25, 2022, a spokesperson for a threat group called DAIXIN Team contacted HIPAA Journal to share information about a ransomware attack and data theft incident at Fitzgibbon Hospital in Marshall, Missouri. DAIXIN Team was previously not known to HIPAA Journal and appears to be a new ransomware group.

Ransomware 116

Ransomware Hospitals HIPAA Health Insurance 116

HIPAA Journal

OCTOBER 7, 2022

Anthem has confirmed that the protected health information of certain plan members has been compromised in a data breach at its vendor, Choice Health. Choice Health was provided with the data of plan members to perform its contracted duties. CareOregon Reports August 2022 Mailing Error.

HIPAA 99

HIPAA Health Insurance Medicaid Medicaid 99

HIPAA Journal

MARCH 15, 2023

According to the breach notification, ILS identified suspicious activity within its computer systems on July 5, 2022. Assisted by third-party cybersecurity experts, ILS determined that unauthorized individuals accessed its network between June 30, 2022, and July 5, 2022, and acquired files containing sensitive data.

HIPAA 111

HIPAA Health Insurance Medicaid Medicaid 111

HIPAA Journal

DECEMBER 23, 2022

A spreadsheet containing plan members’ names, phone numbers, email addresses, addresses, Social Security numbers, and/or Taxpayer ID numbers was emailed from the employee’s work account to a personal email address on June 17, 2022. HIPAA Journal has not been able to confirm how many individuals have been affected. The Louis A.

HIPAA 98

HIPAA Health Insurance 98

HIPAA Journal

FEBRUARY 16, 2022

A comprehensive review was conducted of all files on its systems that could have been accessed by the attackers, and Morley Companies then started collecting contact information for those individuals to allow notification letters to be sent.

HIPAA 127

HIPAA Health Insurance 127

HIPAA Journal

OCTOBER 17, 2022

Valle de Sol did not state in its notification letters when hackers gained access to its network, or for how long they had access, but did confirm that the unauthorized activity was detected on January 25, 2022. A comprehensive review was conducted of all files that may have been accessed, which was completed on July 18, 2022.

Health Insurance 115

Health Insurance Licensing Fraud HIPAA 115

HIPAA Journal

JUNE 15, 2022

The South Carolina-based health insurance company, Choice Health, now part of Alight Solutions, has recently announced that the protected health information of some of its members has been obtained by an unauthorized individual. MCG Health Announces Data Theft Incident.

Ransomware 138

Ransomware Health Insurance Fraud HIPAA 138

HIPAA Journal

JANUARY 13, 2023

The attack was detected on November 7, 2022, and steps were taken to contain the attack and secure its systems. Notification letters were mailed to affected individuals on January 6, 2022. Notifications were mailed to affected individuals on December 30, 2022. Quality Behavioral Health – Hacked Network Server.

Health Insurance 106

Health Insurance Licensing HIPAA Hospitals 106

MedTrainer

AUGUST 15, 2022

HIPAA has placed many restrictions on telehealth services. Telehealth Compliance and HIPAA: What You Need to Know. First, let’s take a brief look at HIPAA as a refresher. The Health Insurance Portability and Accountability Act (HIPAA) exists to provide regulations and best practices for sharing sensitive healthcare data.

HIPAA 52

HIPAA Telemedicine COVID-19 Compliance 52

HIPAA Journal

MARCH 31, 2023

Atlantic Dialysis Management Services – Ransomware Attack Atlantic Dialysis Management Services in New York has recently reported a cyberattack to the HHS’ Office for Civil Rights that was discovered on June 9, 2022. According to the HIPAA business associate, no evidence of misuse of patient data was identified.

Hospitals 103

Hospitals Ransomware HIPAA Health Insurance 103

Compliancy Group

AUGUST 19, 2022

On Friday afternoon, July 15, 2022, the Department of Health and Human Services Office for Civil Rights announced 11 enforcement actions against healthcare providers across the country for alleged violations of the HIPAA Privacy Rule right of access provisions. Let’s Simplify Compliance Avoid HIPAA violation fines.

HIPAA 52

HIPAA COVID-19 Compliance Health Insurance 52

HIPAA Journal

MAY 19, 2022

Suspicious activity was detected within its IT environment on March 14, 2022. The forensic investigation confirmed its systems were accessed by unauthorized individuals between March 11, 2022, and March 14, 2022. The breach has been reported to the HHS’ Office for Civil Rights as affecting 119,513 group health plan members.

COVID-19 104

COVID-19 Health Insurance HIPAA Licensing 104

HIPAA Journal

SEPTEMBER 29, 2022

Humana has recently announced that the protected health information of 22,767 individuals has potentially been compromised in a security incident and data breach at one of its business associates – Choice Health – which Human used to sell Medicare products on its behalf.

Health Insurance 108

Health Insurance Medicare Medicare Fraud 108

HIPAA Journal

MARCH 4, 2022

Crossroads Health in Ohio has experienced a cyberattack that disrupted some of its IT systems. The security incident was detected on January 18, 2022, with the subsequent investigation confirming unauthorized individuals had access to its systems between November 18, 2021, and January 18, 2022.

Health Insurance 121

Health Insurance Licensing HIPAA 121

HIPAA Journal

MARCH 21, 2023

ILS Identified the breach in July 2022 and determined unauthorized individuals had access to its network between June 30, 2022, and July 5, 2022. The post Independent Living Systems Sued Over 4 Million-Record Data Breach appeared first on HIPAA Journal. The lawsuit was filed by Joseph G.

Fraud 103

Fraud Health Insurance Medicaid Medicaid 103

HIPAA Journal

NOVEMBER 29, 2022

South Walton Fire District in Florida has recently announced that it was the victim of a ransomware attack in late May 2022. The investigation and subsequent verification of contact information for affected individuals were completed in October 2022. South Walton Fire District Ransomware Attack Affects Up to 25,331 Individuals.

Ransomware 113

Ransomware HIPAA Health Insurance 113

HIPAA Journal

NOVEMBER 23, 2022

The attack occurred between January 26 and January 28, 2022, and while the attack was detected by the firm’s endpoint security solution shortly after the ransomware was executed, it was not possible to prevent the encryption of certain files on its network.

Ransomware 107

Ransomware Fraud Licensing HIPAA 107

HIPAA Journal

SEPTEMBER 30, 2022

Physicians Business Office (PBO), a Parkersburg, WV-based provider of medical practice management and administrative services, has recently disclosed a security incident that occurred in April 2022. That process was completed on September 16, 2022, and notification letters were sent shortly thereafter.

Licensing 105

Licensing HIPAA Health Insurance 105

HIPAA Journal

AUGUST 17, 2022

According to the breach notification sent to the California Attorney General, Practice Resources was the victim of a ransomware attack on April 12, 2022. Brownsville, TX-based Valley Baptist Medical Center has recently started notifying certain patients that some of their protected health information has been exposed and potentially stolen.

Ransomware 122

Ransomware HIPAA Hospitals Health Insurance 122

HIPAA Journal

JANUARY 19, 2023

RSM was contacted by a person who claimed to be an Iolo employee who said he was aware that RSM’s computer had been hacked and requested access to clean the computer of viruses and malware. Notifications were sent to affected individuals on December 29, 2022.

HIPAA 94

HIPAA Health Insurance 94

HIPAA Journal

AUGUST 2, 2023

The administrative service provider said suspicious activity was detected within its network in early December 2022, and the forensic investigation confirmed on December 15, 2022, that an unauthorized third party accessed parts of its computer network where personal health information was stored.

Licensing 71

Licensing Electronic Medical Records Ransomware Health Insurance 71

HIPAA Journal

AUGUST 3, 2022

The health insurer Aetna ACE is one of the latest healthcare organizations to announce it has been affected by a ransomware attack on a mailing vendor, which involved the protected health information of 326,278 plan members. The ransomware attack affected OneTouchPoint, which provides printing and mailing services for U.S.

Ransomware 125

Ransomware HIPAA Health Insurance 125

HIPAA Journal

MAY 10, 2023

Contact information was then verified, and notification letters were sent on May 1, 2023. McPherson Hospital – Ransomware Attack McPherson Hospital in Kansas has recently issued notification letters to 19,020 patients to alert them about a July 2022 ransomware attack. The unauthorized access was traced to a former employee.

Hospitals 97

Hospitals Ransomware Health Insurance Fraud 97

HIPAA Journal

SEPTEMBER 22, 2022

The cyberattack was detected by the hospital on July 12, 2022, and immediate action was taken to contain the incident and prevent further unauthorized access, and forensics experts were engaged to determine the nature and scope of the attack. Notification letters were sent to the 23,379 affected individuals on September 9, 2022.

Hospitals 76

Hospitals HIPAA Health Insurance Medicaid 76

HIPAA Journal

MARCH 11, 2022

The data breach in question was reported by Logan Health in February 2022, with its investigation confirming unauthorized individuals had access to its system between November 18, 2021, and November 22, 2021. The post Logan Health Facing Class Action Lawsuit Over Data Breach appeared first on HIPAA Journal.

HIPAA 111

HIPAA Health Insurance Medical Billing Fraud 111

HIPAA Journal

FEBRUARY 27, 2023

The Hutchinson Clinic Reports December 2022 Hacking Incident The Hutchinson, KS-based healthcare provider, The Hutchinson Clinic, has recently announced that hackers accessed its network between December 19, 2022, and December 22, 2022, and during that time, files containing patient data may have been accessed and stolen.

Licensing 76

Licensing HIPAA Health Insurance 76

HIPAA Journal

JULY 5, 2022

The email system was immediately secured when the breach was detected with the forensic investigation confirming that two email accounts had been accessed by an unauthorized third party between January 12, 2022, and January 19, 2022. A limited number of patients also had financial account information exposed.

Licensing 101

Licensing Electronic Medical Records Health Insurance Hospitals 101

HIPAA Journal

MAY 2, 2023

NYSARC Columbia County Chapter Notifies Individuals About July 2022 Ransomware Attack NYSARC Columbia County Chapter (COARC) has started notifying certain individuals that some of their protected health information has potentially been obtained by unauthorized individuals in a July 2022 ransomware attack.

Ransomware 95

Ransomware Licensing Health Insurance HIPAA 95