Recent HHS HIPAA enforcement underscores malicious insiders

© yavdat - stock.adobe.com

A lot of focus is placed on ransomware attacks and external actors. While this is warranted because of the relentless and innovative types of external attacks, neglecting insider threats can be equally as costly.

On February 6, the United States Department of Health and Human Services Office for Civil Rights (HHS-OCR) announced a $4.75 million settlement with a New York non-profit hospital system for multiple violations of the HIPAA Security Rule. Additionally, a two (2) year corrective action plan was entered into by the parties. By now, every healthcare industry participant should have it ingrained that protecting patient privacy by implementing adequate technical, physical, and administrative safeguards to ensure security is required and has been for nearly two decades.

Here are the key take-aways from the settlement:

• Factual background - May 2015, the New York Police Department informed Montefiore Medical Center that there was evidence of theft of a specific patient’s medical information. The incident prompted Montefiore Medical Center to conduct an internal investigation. It discovered that two years prior, one of their employees stole the electronic protected health information of 12,517 patients and sold the information to an identity theft ring. Montefiore Medical Center filed a breach report with OCR.
• HIPAA Security Rule violations - failures by Montefiore Medical Center to analyze and identify potential risks and vulnerabilities to protected health information [i.e., not conducting an annual risk analysis], to monitor and safeguard its health information systems’ activity, and to implement policies and procedures that record and examine activity in information systems containing or using protected health information.
• Corrective Action Plan requirements:
  • Conducting an accurate and thorough assessment of the potential security risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information;
  • Developing a written risk management plan to address and mitigate security risks and vulnerabilities identified in the Risk Analysis;
  • Developing a plan to implement hardware, software, and/or other procedural mechanisms that record and examine activity in all information systems that contain or use electronic protected health information;
  • Reviewing and revising, if necessary, written policies and procedures to comply with the HIPAA Privacy and Security Rules; and
  • Providing training to its workforce on HIPAA policies and procedures.

The items that are required and are being monitored by HHS-OCR in the corrective action plan should not be surprising. OCR Director Rainer’s comments sum up why compliance is so important. “Unfortunately, we are living in a time where cyber-attacks from malicious insiders are not uncommon. Now more than ever, the risks to patient protected health information cannot be overlooked and must be addressed swiftly and diligently, … This investigation and settlement with Montefiore are an example of how the health care sector can be severely targeted by cyber criminals and thieves—even within their own walls.”

Rachel V. Rose, JD, MBA, advises clients on compliance, transactions, government administrative actions, and litigation involving healthcare, cybersecurity, corporate and securities law, as well as False Claims Act and Dodd-Frank whistleblower cases.