Phishing Risks and Notification Delays: A Lesson in Managing a HIPAA Breach

4.24.25

As we head into the middle of the year, it’s safe to say that the Office for Civil Rights (OCR) is ramping up enforcement. Since the beginning of this year, over $6M in fines have been levied, with new penalties being announced weekly. 

The latest fine showcases that the OCR can and will investigate breaches no matter your organization’s size. The latest HIPAA fine was imposed on PIH Health, Inc. (PIH), a California health network comprised of over a hundred health practices throughout the state. 

PIH’s HIPAA violations have cost the organization $600,000. Due to these violations, the organization will be monitored for two years under a Corrective Action Plan (CAP).

These violations exposed numerous shortcomings of the organization due to a phishing attack, emphasizing the importance of thorough safeguards for practices of all sizes. 


What Happened? 

In June 2019, a phishing attack compromised 45 PIH employee accounts. This breach devastated an organization with millions of patients, putting nearly 200,000 patients at risk. 

While the phishing attempt occurred in the summer of 2019, the breach was not reported to affected patients or the OCR until January 2020. 

When a breach impacts over 500 patients, time is of the essence. Parties must be notified within 60 days of the breach, including widespread press releases for the media. 

More issues were brought to light once the OCR was aware of this breach. The organization lacked a sufficient Security Risk Analysis (SRA). The SRA is an exhaustive assessment of a practice, reviewing all safeguards and highlighting any vulnerabilities before a breach occurs. 

This is at the base of a compliant practice, and the OCR has introduced the Risk Analysis Initiative to ensure that practices have this documentation in place. 

Overall, this successful phishing attempt revealed inadequacies and several HIPAA violations. In addition, the organization’s failure to notify the OCR and patients promptly also contributed to the severity of the fine.


Protecting Patient Data

The healthcare industry’s sensitive data makes it the prime target for phishing attacks. Healthcare organizations must provide comprehensive staff training to avoid suspicious emails and, in general, risk mitigation techniques. 

Healthcare practices must always address the breaches quickly. Timely notification of the OCR and affected patients ensures that all parties are aware of the breach’s impact and understand how to monitor their data.

No matter the organization’s size, using smart software can help simplify compliance, avoid significant fines, and reduce patient data risk. For example, the SRA can be streamlined with compliance software, ensuring your practice knows the appropriate safeguards before an incident occurs. Intelligent solutions also provide your practice with a centralized compliance hub, letting staff know precisely what they need to secure patient Protected Health Information (PHI). 

To learn more about how your practice can streamline common HIPAA violations, schedule a meeting with a compliance expert today.

RECENT POSTS

Related posts

Risk Analysis Initiative HIPAA Fine
Abyde News, Fines, HIPAA

Don’t Be Next: HIPAA Fine Shows Risk of Ignoring Security Risk Analysis

April 17, 2025 No comments yet

April 17, 2025 Let’s make this clear: The Security Risk Analysis (SRA) is at the foundation of a compliant practice. The SRA is the proactive assessment of your practices’ physical, technical, and administrative safeguards. Physical safeguards include alarms, codes, and other procedures or devices your practice might deploy. Technical safeguards involve cybersecurity protocols, like firewalls, antivirus software, encryption, and other security measures. Lastly, the administrative safeguards are your practice’s actions, such as using visitor IDs, maintaining a sign-in sheet, or even posting about patients on social media. The latest HIPAA fine is another reminder of the importance of the SRA in protecting patient data. This is the sixth Risk Analysis Initiative enforcement since the end of last year. The Office for Civil Rights (OCR) is serious about ensuring that practices know this requirement. This focus has remained consistent even during administration transitions. Said best by OCR Acting Director Anthony Archeval, “A failure to conduct a risk analysis often foreshadows a future HIPAA breach.”   What Happened?  Northeast Radiology, P.C. (NERAD), a healthcare provider specializing in medical imaging clinical services in New York and Connecticut, experienced a significant breach that exposed nearly 300,000 patients’ Protected Health Information (PHI). The breach, which occurred from April 2019 to January 2020, was caused by unauthorized individuals accessing radiology images of patients due to a compromised server. When the OCR began investigating the practice in March 2020, it was discovered that NERAD did not have an SRA. Due to the absence of this document and the sheer size of the breach, the organization was fined $350,000 and will undergo a two-year Corrective Action Plan (CAP).   Completing an SRA NERAD’s HIPAA settlement with the OCR is a clear reminder that your practice needs to complete an SRA long before a breach occurs. While an SRA might seem daunting, addressing problems before patients’ information is at risk is much easier. Completing this risk assessment can help your practice identify vulnerabilities before they escalate into compliance issues. While the SRA mandates practices to analyze and review existing procedures thoroughly, this process doesn’t need to be overwhelming or costly. With smart solutions, your practice can answer simple questions about your practice while the software intuitively builds out an SRA report, analyzes the current situation, and provides recommendations to mitigate potential risks. To learn more about how your practice can streamline the SRA, schedule a consultation with an expert today.

HIPAA Audit Program
Abyde News, Audits, HIPAA

The HIPAA Audit Wake-Up Call: Is Your Practice Compliant?

April 10, 2025 No comments yet

April 10, 2025   The HIPAA Audit program is back in business.  Since the introduction of the Health Information Technology for Economic and Clinical Health (HITECH) Act, the Office for Civil Rights (OCR) has been able to audit practices, ensuring they follow HIPAA standards.  While the revival of the audit program was announced last May, new information was confirmed at the latest HIPAA Summit, with 50 Covered Entities and Business Associates being selected to be audited. This program was last active from 2016-2017, which highlighted that, unfortunately, noncompliance with HIPAA is far too common in regulated entities. In fact, only 14% of Covered Entities, like medical practices, could produce a compliant Security Risk Analysis (SRA).  The healthcare industry is entering a new era of HIPAA compliance in the wake of the largest ever healthcare data breach. New HIPAA legislation is being reviewed and the Office of the Inspector General (OIG) is recommending stricter audit processes. With millions in fines already imposed in 2025, proactive preparation is now critical for healthcare providers and their business partners.   What is the Audit Program?  The audit program was first introduced when the HITECH Act was enacted in 2009. While the majority of the investigations the OCR conducts are reactive, resulting after a patient complaint or a breach, the audit program is random.  The OCR will thoroughly review the selected organization’s documentation and current processes as the audit program resumes. A compliant HIPAA program entails much more than training; it also requires comprehensive, continuous protocols to ensure patient data is being protected.  The basis of a compliant practice is being able to present an SRA. As stated earlier, previous audit programs spotlighted the shortcomings of regulated entities completing this.  The SRA is a thorough assessment of your practice. This includes reviewing the safeguards your practice currently has in place. Technical, physical, and administrative safeguards all play a role in securing Protected Health Information (PHI).  This would include a deep dive into the technology your practice uses, the physical protections your practice might have (like alarms), and the administrative policies your practice follows.  Completing this analysis will allow your practice to identify vulnerabilities before a breach occurs. Proactive compliance, addressing issues before they affect patients, is key to a successful practice.  In addition to providing an SRA, practices must also prove compliance with other pillars of HIPAA compliance, such as the Right of Access (or sending requested medical records to practices in a timely manner), the Breach Notification Rule, the Privacy Rule, and more.  After the rise in ransomware attacks in recent years, with a nearly 300% increase in ransomware-related breaches, regulated entities’ cybersecurity practices will likely be scrutinized, ensuring that those audited are aware of their technology responsibilities.    What can I do?  Your practice must be aware of HIPAA and implement the appropriate safeguards to be prepared for the possibility of an audit. While this can be a daunting task, it is imperative for your practice to follow HIPAA compliance before a situation occurs. Thankfully, smart software can streamline and simplify HIPAA for your practice, providing a roadmap to compliance. With the right solution, your practice can see exactly what the OCR requires, which will be asked for if ever audited.  To learn more about becoming audit-ready, schedule an educational consultation with our team of experts.

HIPAA Compliant Communication
Abyde News, Best Practices, HIPAA

Navigating HIPAA in the Digital Age: Patient Communication Essentials

April 2, 2025 No comments yet

April 2, 2025   When 80% of patients prefer digital communication, exploring this opportunity to better serve your patients is crucial. In the digital world, it’s easier than ever to connect with others and build relationships with others through technology. Connecting with patients via technology is simple, but practices must ensure that all communication, including emails, texts, and calls, adheres to HIPAA regulations.   What is HIPAA-Compliant Communication? HIPAA, or the Health Insurance Portability and Accountability Act, is focused on ensuring the security of patients’ Protected Health Information (PHI). PHI includes anything personally identifiable about a patient, including Social Security Numbers, full names, addresses, medical history, and more.  When communicating with a patient, it’s vital to implement the proper protocols to keep patient data safe. When patient data isn’t secured through traditional channels, using a regular phone doesn’t cut it. For instance, channels need to be encrypted, providing extra layers of protection.  Additionally, it’s important to communicate with patients using the minimum amount of information necessary for a conversation. For example, if a patient texts asking to reschedule an appointment, a practice should offer new times and not go in-depth about a patient’s medical history. Communication should remain brief and focus on justifiable reasons to talk to a patient, like scheduling, post-op instructions, and test results.  Patients need to consent to different forms of communication, like texts. The practice is responsible for receiving consent when a patient begins seeing a practice.    How can I Implement HIPAA-Compliant Communication?  An encrypted communication service is the easiest way to ensure secure communication channels. As communication with patients has become normalized in the healthcare industry, numerous organizations offer HIPAA-compliant communication systems. These systems include compliant and encrypted end-to-end phone calls, texts, and emails. Ensure these companies also do their due diligence and sign a Business Associate Agreement (BAA) with your communications provider.  Once a suitable communication system is in place, training staff on communicating effectively and safely with patients electronically is crucial. Staff should be well-versed in the proper procedures for digital patient communication. This includes understanding the Minimum Necessary standard, carefully reviewing messages before sending them to patients (especially to ensure information is being sent to the correct patient), and recognizing phishing scams to verify the authenticity of communications before responding.   What’s Next? Communicating with patients leads to a more successful practice, with higher attendance rates and more engaged patients. Digital communication is the future, and with the right tools, you can easily navigate HIPAA-compliant communication.  In addition to using digital communication systems, implementing a smart software solution is key to a compliant practice. A centralized compliance hub allows you to easily see your vulnerabilities and organize vital documentation, like BAAs with third-party vendors you may use.  Looking to learn more about how you can make your practice more efficient while still following rigorous HIPAA laws? Schedule a meeting with a compliance expert today. 

Is your practice prepared for a HIPAA investigation? Get educated with our new eBook.

DOWNLOAD NOW
X