On November 19, 2020, the Office for Civil Rights (OCR) announced its 10th HIPAA Right of Access settlement of the year. OCR publicized its first five Right of Access settlements this year just over two months ago. It added two more in October and then three in November. And with a full month left in 2020, there may be more to come.
Right of Access enforcement is climbing and fast. Last week, OCR announced its 9th Right of Access resolution this year and its 11th such resolution since the Right of Access enforcement initiative began in 2019. Right of Access enforcement is swift, driven by patient complaints and has cost provider 9 providers a combined total of nearly half a million in settlement costs this year.
Historically, it often takes the Department of Health and Human Services’ Office for Civil Rights (OCR) five or more years to complete an investigation, bring an enforcement action and announce a resolution. That’s changing.
Part II: A deeper dive into the Risk Analysis One of the most common non-compliance findings by the Office for Civil Rights (the governmental entity that enforces HIPAA) is failure to perform or performing an inadequate risk analysis. In this session, we will dive deeper into the risk analysis requirement and look at the structure […]
One of the most common areas of enforcement under HIPAA involves a failure to perform an accurate and thorough risk analysis. Despite the known enforcement history and growing frequency of cybersecurity incidents, lack of compliance with the risk analysis requirement is very common. I sat down with Sammy De La O of IT Direct to get his perspective on performing a risk analysis and addressing the results.
Part I: How to Improve Your Cybersecurity Defenses Through HIPAA Security Rule Compliance HIPAA Security Rule compliance significantly reduces the risk that a healthcare entity will suffer a cyber incident. During this session, we will look closely at three key HIPAA Security Rule requirements and examine the processes and technologies that both enable compliance as […]
Less than a month after announcing five right of access enforcement action resolutions in one day, the Office for Civil Rights (OCR) announced two more last week.
In just one week, OCR announced settlements totaling $10.6 million with three organizations for alleged systemic HIPAA Security Rule violations. In each of the three cases, the entity self-reported a hacking incident. Combined, the hacking incidents compromised the health information of more than 16 million people. While it’s not common to see three large settlements in one week, enforcement for HIPAA Security Rule non-compliance is not new and likely will continue with increasing intensity.
October is Cybersecurity Awareness Month! It’s no secret that healthcare entities and the businesses that serve them are a popular target for cybercriminals – costing millions each year and damaging reputations. In fact, hacking and IT incidents are the leading cause of reported HIPAA breaches. Healthcare executives need to understand both the risks and […]
Today, OCR announced its largest HIPAA enforcement settlement so far this year. An orthopedic clinic agreed to pay $1.5 million and to adopt a corrective action plan after a 2016 hacking incident that compromised over 200,000 patient records. OCR’s investigation revealed systemic HIPAA Privacy and Security Rule issues. This settlement confirms that HIPAA Security Rule violations remain an important enforcement focus, that post-incident compliance will not excuse pre-incident noncompliance and that seven figure settlements are not reserved just for large hospital systems.