Deer Oaks HIPAA Fine

Ransomware Strikes Again: What the Latest HIPAA Fine Teaches Us

July 28, 2025 Penelope Schweitzer No comments yet

July 28, 2025 Healthcare’s cybercrime nightmare just got more expensive. With over half a million dollars in fines and the second HIPAA ransomware fine issued this month alone, it’s time to acknowledge the serious threat cybercrimes pose to healthcare. The Office for Civil Rights (OCR) just announced its latest HIPAA fine, following a ransomware attack affecting a surgery center in New York, totalling $250,000 and placing the practice under a two-year Corrective Action Plan (CAP). The two-year period includes constant government monitoring, ensuring the healthcare provider has taken action to mitigate risks and secure Protected Health Information (PHI). Here’s where things get interesting. Upon further inspection, the exact ransomware variant, PYSA, explicitly targets the healthcare industry. Think about it: cybercriminals know the absolute treasure trove of sensitive patient data a healthcare organization holds. As malicious actors know the importance of patient health records, your practice must be extra vigilant when handling PHI. What Happened? In March 2021, an unauthorized actor gained access to the networks of Specialty Surgery Center of Central New York (also known as Syracuse ASC, LLC). The hacker deployed ransomware in the organization’s networks for over two weeks. This ransomware exposed nearly 25,000 patient records, with access to Social Security numbers, addresses, health histories, and more. Syracuse ASC, LLC, notified the OCR of this breach in October 2021, over six months after the initial intrusion. This wait violated the HIPAA Breach Notification Rule. Given the massive breach, the healthcare provider had to notify the OCR, patients, media, and potentially the State Attorney General within 60 days of discovery. Notifying these parties allows patients to take control and explore options for protecting and monitoring their data post-breach. Additionally, it could have expedited the OCR and State officials’ investigations into the extent of the ransomware attack. During the investigation process, the OCR made another startling discovery: no Security Risk Analysis (SRA) was in place. A thorough SRA is required to maintain your practice’s security. By examining existing safeguards, you can identify and address vulnerabilities proactively before they cause problems. This practice learned the hard way about a common HIPAA pitfall: missing an SRA. Due to this, a hacker infiltrated and exploited the vulnerability of an insecure network, leading to a quarter-million-dollar fine. Protecting Your Practice Against Ransomware Hackers have discovered a gold mine with medical records costing upwards of $1000 on the dark web, compared to the average credit card number fetching 25¢. When hackers directly target healthcare practices, your compliance program and safeguards must be in order. Proactive compliance is key to the security of PHI. Your practice can mitigate and minimize ransomware threats by using the right compliance solutions and robust IT assistance. With the right software, it’s easy to streamline pillars of HIPAA compliance, like the SRA, identifying issues early to avoid risking your patients. Meet with our team of experts to learn more about how you can simplify HIPAA compliance for your practice.

Abyde News, Best Practices, HIPAA

Strong Passwords, Secure Patients: Protecting PHI in Healthcare

July 23, 2025 Penelope Schweitzer No comments yet

July 23, 2025 While Password123 might be easy to remember, it might not be the best password. In our current healthcare landscape, intertwined with technology, from EHR systems to patient communication, it’s time to upgrade password security. A strong password and other layers of protection are key to keeping your practice’s logins secure and, ultimately, patient Protected Health Information (PHI). Thorough password management might be the deciding factor in stopping a major breach. Just look at the Change Healthcare debacle. Billions of dollars lost, systems crashed, insurance claims in limbo, and over 100 million patients exposed. At the root of this? Missing multi-factor authentication (MFA). After major breaches caused by poor password management, it’s time to prioritize your passwords and adhere to best practices. Ditch the Default Password Let’s face it. It’s tempting to use passwords everywhere. However, it’s a password security red flag. When it comes to passwords, we recommend at least eight characters with several unique characters, including a number, an uppercase letter, a lowercase letter, and a symbol. This enhanced security makes unauthorized account access more challenging. Also, if one account is compromised, the breach can be more easily contained than if all logins shared the same password. On that note, ensure all staff have their own logins. This isn’t just about stopping password sharing; it’s about giving your practice the power to keep a close eye on who’s accessing Protected Health Information (PHI) and quickly spotting anything out of the ordinary. When in Doubt, Change it Out We also recommend changing passwords at least three times a year, keeping account access current, and making unauthorized users’ access more difficult. Regular password changes help mitigate risk if an older password is exposed in a data breach, and make it harder for hackers to brute-force guess your password. They also ensure that anyone who has lost access to your accounts, such as offboarded staff, cannot continue to access systems. By consistently making password changes a part of your security routine, you create a dynamic defense that significantly reduces the risk of unauthorized access. Your Password’s Best Friend: Multi-factor Authentication On top of having a secure and current password, having MFA enabled on all your accounts is key to keeping PHI safe. Just like peanut butter and jelly, passwords and MFA are a perfect pair. MFA is that crucial next step, providing an extra layer of security that makes a major difference in keeping your information safe. Common MFA examples include a text, a random code generated, or even through an automated call. That extra protection ensures that the person logging in is authorized and authenticated. This extra level of protection ensures that when someone tries to log into your accounts, it’s truly you. It’s all about verifying and authenticating that the person accessing the account is authorized. With MFA enabled, a hacker won’t be able to log in without that unique code sent to your phone, an app, or even your email. This significantly increases the difficulty for unauthorized access, giving you peace of mind that your PHI remains secure. Securing your Compliance Program The sheer volume of tasks can make managing compliance feel like a full-time job, from multi-factor authentication to complex password policies and regular access reviews. While it’s easy to feel overwhelmed, your practice can streamline this with the right solution. Smart software simplifies compliance for your practice by sending out compliance reminders, such as when it’s time to change your password, providing best tips and practices, and automating policies and procedures for your practice. Meet with an expert today to see how you can streamline compliance for your practice.

Abyde News, Fines, HIPAA

The Bite of HIPAA: True Stories of Dental HIPAA Fines

July 15, 2025 Penelope Schweitzer No comments yet

July 15, 2025 Running your dental practice comes with its unique set of challenges. You’re wearing multiple hats, and it’s a stressful fashion statement. While OSHA is always on your radar, just from the nature of dentistry, forgetting about HIPAA can be costly. While you think your practice would never be in the hot seat, small dental practices, you’d be mistaken. See how to avoid these common pitfalls in your dental practice, allowing you to continue running it effectively. Time is of the Essence: Right of Access Under the HIPAA Privacy Rule, HIPAA not only defines how Protected Health Information (PHI) needs to be secured but also how it needs to be shared with authorized parties. Right of Access is a part of this rule. This rule requires healthcare providers to deliver requested patient records within 30 days of the patient’s request. Gums Dental Care, a small Maryland dental practice, was fined for violating this HIPAA requirement. The patient initially requested their records in April 2019. The practice did not provide records until May 2022. The patient alerted the Office for Civil Rights, which started a long, overwhelming journey for Gums Dental. The OCR intervened countless times, requiring the practice to provide the patient with their records. The dental practice continued to refuse to provide the patient with records, leading to more legal battles, money, and time wasted. The grand finale? Over three years from the date of the first request, and countless interventions from the OCR, the practice was fined $70,000. Less is More As the saying goes, “If you can’t say anything nice, don’t say anything at all.” This rule applies to all forms of communication and also works to avoid HIPAA violations. While social media brings people together, you must tread a fine line when handling PHI and posting online. One part of this is responding to patient reviews. You cannot confirm or deny that a patient attended your practice, even if the patient is talking positively about their experience there. If you’d like to use someone’s story for marketing materials, like a before-and-after photo of their smile, ensure they sign a consent form. If someone leaves a negative review, you cannot defend your practice by sharing information about the patient. For example, if a patient consistently posts bad reviews but fails to mention that they are always late, you should not call them out publicly online. Instead, address the issue privately and communicate with them securely. Dentists have been fined for social media violations. Dr. U. Phillip Igbinadolor, a dentist in North Carolina, lost his temper after a patient left a negative review on the practice’s Google page. After the dentist posted PHI in response, ridiculing the patient, the patient reported him to the OCR. As a result, the OCR fined the practice $50,000, showing that the price of failing to simply “keep your words to yourself” can be extraordinarily steep. Coming Clean is Key With cybercrimes in healthcare skyrocketing and large data breaches due to ransomware attacks increasing by 264%, having the proper safeguards in place is crucial. While no practice can be completely immune from a breach, the right barriers in place can mitigate risk and minimize impact. However, if your practice is breached, you must notify the OCR and patients quickly. Under the HIPAA Breach Notification Rule, patients must always be notified within 60 days, regardless of the size of the breach. If the breach affects fewer than 500, your practice must inform the OCR within 60 days after the calendar year in which the event occurred. If a breach affects more than 500, the OCR, and depending on the state, the Attorney General, must be notified within 60 days as well. The Indiana Attorney General recently fined Westend Dental, a multi-location dental practice in Indiana, for its response to a ransomware attack. While the breach occurred in October 2020, the practice did not alert the required parties until October 2022, two years after the initial attack. The Attorney General began investigating this attack after a patient complaint, and it was then discovered that the practice attempted to cover up a ransomware attack. The investigation discovered that, in addition to violating the HIPAA Breach Notification Rule, Westend Dental had improper training, unprotected servers, no Security Risk Analysis (SRA), missing policies, and more. The outcome? A $350,000 fine from the Attorney General, highlighting the importance of proactive compliance and properly notifying affected parties after a healthcare breach. How to Protect Your Dental Practice While compliance for your dental practice might feel overwhelming, the right solutions can streamline your compliance program. Smart software solutions can pinpoint vulnerabilities and provide actionable insights to avoid common pitfalls dental practices face. The right compliance software can also provide a comprehensive hub for everything HIPAA-related for your practice, including right of Access training, social media guidelines, and the SRA. Meet with a compliance expert today to learn more about streamlining compliance for your dental practice.

Double Trouble, Major Fine: How Two Breaches Cost Deer Oaks $225,000

What Happened?

Protecting Your Practice

RECENT POSTS

From Our Blog

Solutions

Resources

Company