HHS Reaches Second Ever Settlement for Ransomware Attack

The settlement involved a cyberattack that occurred back in 2019.

By HFT Staff


The U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR), announced a settlement under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) with Green Ridge Behavioral Health, LLC, a Maryland-based practice that provides psychiatric evaluations, medication management and psychotherapy. OCR enforces the HIPAA Privacy, Security, and Breach Notification Rules, which sets forth the requirements that HIPAA covered entities (most health care providers, health plans, and health care clearinghouses) and their business associates must follow to protect the privacy and security of protected health information. The settlement resolves an investigation following a ransomware attack that affected the protected health information of more than 14,000 individuals. This marks the second settlement that OCR has reached with a HIPAA regulated entity for potential violations identified during an investigation following a ransomware attack. 

In February 2019, Green Ridge Behavioral Health filed a breach report with OCR stating that its network server had been infected with ransomware resulting in the encryption of company files and the electronic health records of all patients. OCR’s investigation found evidence of potential violations of the HIPAA Privacy and Security Rules leading up to and at the time of the breach. Other findings included that Green Ridge Behavioral Health failed to: 

  • Have in place an accurate and through analysis to determine the potential risks and vulnerabilities to electronic protected health information; 
  • Implement security measures to reduce risks and vulnerabilities to a reasonable and appropriate level; and 
  • Have sufficient monitoring of its health information systems’ activity to protect against a cyber-attack. 

Under the terms of the settlement, Green Ridge Behavioral Health agreed to pay $40,000 and implement a corrective action plan that will be monitored by OCR for three years. The plan identifies steps that Green Ridge Behavioral Health will take to resolve potential violations of the HIPAA Privacy and Security Rules and to protect electronic protected health information, including: 

  • Conducting a comprehensive and thorough analysis of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information; 
  • Designing a risk management plan to address and mitigate security risks and vulnerabilities found in the risk analysis; 
  • Reviewing, and as necessary, developing, or revising its written policies and procedures to comply with the HIPAA Rules; 
  • Providing workforce training on HIPAA policies and procedures; 
  • Conducting an audit of all third-party arrangements to ensure appropriate business associate agreements are in place, where applicable; and 
  • Reporting to OCR when workforce members fail to comply with HIPAA. 


February 27, 2024


Topic Area: Information Technology , Security


Recent Posts

On the Lookout: The Software Supply Chain as a Healthcare Cyberattack Vector

Staying watchful of third-party software vendors and their activities is critical for healthcare cybersecurity.


Hackensack Meridian Health & Wellness Center at Clifton Opens

The Clifton center expands health care access in Passaic County by reducing barriers such as travel and wait times.


Suffolk Breaks Ground on Expansion of White Plains Hospital

The 10-story, approximately 500,000-square-foot expansion is slated to open in 2028.


EVS Leadership Culture Critical in Preventing Hospital-Acquired Sepsis

Cleaning is an essential yet complex component for the prevention of HAI-induced sepsis.


Man Dies by Suicide in Emergency Department Waiting Room at Kansas Hospital

No staff or patients were harmed, and the man was alone in the waiting area when he shot himself.


 
 


FREE Newsletter Signup Form

News & Updates | Webcast Alerts
Building Technologies | & More!

 
 
 


All fields are required. This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.