Breach

How to Mitigate a HIPAA Breach
Abyde News, Best Practices, HIPAA

Is Your Practice Prepared for a HIPAA Breach?

February 10, 2025 No comments yet

February 10, 2025  Welcome to Abyde’s HIPAA Investigation Survival Series. HIPAA investigations can last for years, making it one of the most stressful experiences a practice can endure. It’s vital your practice understands the investigation process. The first step of the HIPAA investigation is the breach itself. Experiencing a data breach is pretty common in healthcare and can affect organizations of all sizes. For example, the Change Healthcare breach, a subsidiary of UnitedHealthcare, exposed at least 100 million patients’ data. While they might be common, it’s still your practice’s responsibility that the proper precautions are put in place to mitigate risks. What is a Breach? A breach is any impermissible disclosure of Protected Health Information (PHI) without authorization. PHI is data that can individually identify a patient, including information like Social Security numbers, birth dates, medical records, and more. Healthcare faces significant data breaches due to various threats, including stolen computers and unauthorized access. However, the largest threat by far comes from ransomware and cybercrimes. Ransomware reports to the Office for Civil Rights have increased 264% in the last five years. Ransomware can infect systems through several channels, like email. Successful phishing attempts are the most common way malicious actors hack healthcare systems. That’s why it’s imperative to provide proactive training to staff, ensuring they are aware of common phishing scams and how to handle spam emails when they arrive, such as forwarding them to IT or immediately sending them to spam. If my practice is breached, what do I do? If your practice is breached, handling the situation calmly is important. Time is of the essence when it comes to HIPAA breaches, with every second pivotal for a hacker to leak more information. When becoming aware of a HIPAA breach, your practice must take the infected device offline and review the scope of the hack. In situations like these, Based on the size of your organization, it’s important to have an in-house or outsourced IT team to navigate you through the technical process. A breach report needs to be filed as well. This can depend on the size of the breach, with breaches impacting less than 500 needing to be filed within 60 days from the end of the year and large breaches, or 500+, needing to be reported to the OCR within 60 days of discovering the breach. This report needs to be filed here. The state where a breach occurs is a crucial factor, as some states have stricter requirements, including shorter timelines. In either situation, affected patients need to be notified. Under the Breach Notification Rule, patients must be notified within 60 days of discovering the breach. For large breaches, media notice is required, usually in the form of a press release, to ensure impacted patients are aware their health information was put at risk. Once again, depending on the state, different parties, like the State Attorney, need to be notified. What’s Next? The OCR may investigate your practice to ensure you had the proper protocols in place before and if the response after a breach is sufficient. This investigation would take place after breach recovery efforts are completed, such as restoring systems and notifying the necessary parties. A common misconception is a HIPAA fine is due to a cyber attack. Sometimes, breaches occur no matter how many safeguards you have in place. Fines are levied on practices that did not take the proper precautions before an event, such as training staff, having antivirus software, or having a Security Risk Analysis (SRA) in place. The fine is not due to the breach itself, but it triggers an investigation, where fines can be levied for lack of preventative measures. During an investigation, the government looks to see that your practice has taken steps to mitigate and prevent cybersecurity issues before they escalate into a breach. That’s why it’s imperative to implement protective measures for your practice before a breach occurs. Getting compliant can be overwhelming, but with the right tools, you can easily streamline your HIPAA program. Smart software solutions can serve as a comprehensive compliance hub, allowing you to see your practice’s vulnerabilities and offer steps to fix them. To learn more about HIPAA compliance for your practice, meet with a compliance expert today. Read the second installment of the series, focused on the HIPAA Investigation letter here. 

2020 HIPAA Breaches Reporting Deadline
Best Practices, HIPAA, Legislation

2020 HIPAA Breaches Reporting Deadline is March 1st

February 5, 2021 Comments Off on 2020 HIPAA Breaches Reporting Deadline is March 1st

February 5, 2021 2020 was certainly not the year anyone planned, and despite your best intentions, the transition to remote operations and reliance on new technologies may have led your practice to experience a (hopefully minor) HIPAA breach last year. If you had a major breach (500+ patients affected) you’re a little late to the reporting party (breaches affecting over 500 patients should be reported within 60 days, or sooner depending on your state). If fewer patients were affected and you only had a minor breach on your hands, mark your calendars for the upcoming small breach reporting deadline on March 1st.  What types of incidents are HIPAA breaches, and how do I know if I have to report it? Any instance in which protected health information (PHI) was exposed in violation of the HIPAA Privacy Rule or HIPAA Security Rule counts as a breach of HIPAA. This could be as small as sending an email containing PHI to the wrong person, or as big as a hacking incident affecting hundreds of patient records. While we wish there was a ringing alarm to signal a breach has occured, many breaches aren’t as easy to detect. If you just aren’t sure, first assess the scenario to help make that determination – particularly what the risk is that the PHI possibly exposed would be used for ‘malicious intent’. We’re big believers in the “better safe than sorry” mentality, and recommend reporting any incident that could be a breach to meet all the necessary reporting requirements.    What qualifies as a ‘small’ HIPAA breach? HIPAA classifies minor breaches as incidents impacting 500 individuals or less. Even if the breach only involved a single patient, it still counts as a breach and should be reported no later than 60 days after the end of the calendar year (aka, March 1st). The ONLY case in which a breach of this kind might not need to be reported is if you can determine with absolute certainty that the data exposed won’t be misused or has been permanently deleted. (P.S., if your breach fell into that 500+ patients bucket, while you’re a little behind we still recommend submitting a late report, instead of no report at all, to reduce the penalties you might face.) What if my business associate experienced the breach, do I have to report it?  While the Office for Civil Rights (OCR) does encourage business associates to report breaches themselves, the responsibility of getting the report in correctly and on time ultimately falls on the practice. If one of your third-party vendors experienced a breach in 2020, it’s best to check with them to ensure that the breach was reported or report the breach yourself to make sure you’re covered (again – better safe than sorry!). Even if you have a Business Associate Agreement (BAA) in place with the vendor and an incident is completely out of your hands, failing to report the breach by the deadline can still result in HIPAA fines.      Reporting HIPAA breaches of any kind is extremely important to avoiding further fines and penalties. If you do have to make a report – you’re not alone. Only 44% of healthcare organizations actually meet cybersecurity standards, meaning a LOT of organizations wind up with data breaches even if they have solid HIPAA programs in place. There is some good news however with the new HIPAA Safe Harbor Law. You could qualify for reduced HIPAA fines if and only if you can prove that your practice has had the necessary technical safeguards and HIPAA requirements in place for 12 months before the breach. So, the short version? Make sure you report ANY possible or confirmed small breaches that occurred in 2020 by March 1st to avoid further penalties. If you DON’T have a HIPAA program in place but still have a breach to report we highly recommend getting a program in place ASAP to help reduce possible fines or other penalties.  

$5.1 Million Dollar HIPAA Fine
Fines, HIPAA

OCR Announces 2nd HIPAA Settlement of 2021 with Health Insurer for $5.1 Million

January 15, 2021 Comments Off on OCR Announces 2nd HIPAA Settlement of 2021 with Health Insurer for $5.1 Million

January 15, 2021 Buckle your seatbelts – it’s only 15 days into 2021 and it’s already looking like this year will be a wild ride when it comes to HIPAA enforcement. The Office for Civil Rights (OCR) just announced another HIPAA settlement (and a doozy at that), bringing in not one but TWO fines just this week.   The latest (and greatest) HIPAA fine of 2021 was just awarded to Excellus Health Plan, Inc., a health insurance provider serving over 1.5 million people in New York. The settlement includes a whopping $5.1 million fine and a 2-year corrective action plan, the result of cyber attack affecting more than 9 million records along with a slew of other HIPAA Privacy and Security Rule violations. Fun fact: the OCR didn’t reach $5 million in total fines levied until September of last year, and today’s announcement means they’ve already exceeded the $5 million mark just 15 days into 2021 – talk about starting the year off strong!   Excellus’ story all started when the OCR received a breach report on September 9, 2015 that cyber-attackers had gained access to Excellus Health Plan’s information technology systems. Of note with this particular breach story is that the hackers in Excellus’ case were accessing their systems so long, they not only set up shop but practically built a whole mall to go with it – hanging out in the health plans’ database from December 23, 2013 allllll the way until May 11, 2015 – an entire year and a half.  Their overextended stay allowed the hackers to install malware in addition to other malicious activities that provided unauthorized access to the protected health information (PHI) of over 9.3 million individuals – improperly accessing everything from names, to addresses, social security numbers, financial information and clinical treatment information.  If having hackers in your IT system for almost 2 years wasn’t bad enough, the OCR also found that Excellus had violated some pretty important HIPAA rules, including:  As a great example of what NOT to do when it comes to your HIPAA and technical security programs, today’s fine also offered words of wisdom from the OCR: “Hacking continues to be the greatest threat to the privacy and security of individuals’ health information. In this case, a health plan did not stop hackers from roaming inside its health record system undetected for over a year which endangered the privacy of millions of its beneficiaries,” said OCR Director Roger Severino. “We know that the most dangerous hackers are sophisticated, patient, and persistent. Health care entities need to step up their game to protect the privacy of people’s health information from this growing threat.”    One positive when it comes to increasingly concerning cyberthreats? The recently passed HIPAA Safe Harbor Bill offers your practice the chance to receive smaller HIPAA fines (even more important with the whopping $5.1 million precedent just set) IF you have the necessary safeguards in place 12 months BEFORE a cyber event. Even though data breaches and hacking incidents aren’t always in your control, practice’s preparation beforehand is – and could mean the difference between a smaller, manageable fine and ranking among the top 10 greatest hits on the OCR’s fine list.    

What to do after a HIPAA Breach
Best Practices, HIPAA

Your Practice May Have Experienced a HIPAA Breach – Now What?

March 10, 2020 Comments Off on Your Practice May Have Experienced a HIPAA Breach – Now What?

March 10, 2020 Whether you have recently experienced a breach or are just preparing for the worst, it’s important to know what you need to assess in the event that your practice is faced with a HIPAA incident. Any time your Protected Health Information (PHI) is exposed, whether maliciously or accidentally, your practice may be facing serious fines for a HIPAA violation. The first step is knowing what exactly is considered a breach of PHI.  As defined by the U.S. Department of Health and Human Services, a HIPAA breach is the “impermissible use or disclosure under the Privacy Rule that compromises the security or privacy of the protected health information.” This definition is broad and leaves practices to determine if a breach has occurred. If you believe you may have been breached, the next step is to assess your specific level of risk using the following factors:  In any instance where unsecured PHI is involved, properly assessing the level of risk associated with your practice’s potential data breach is an essential first step. Your next steps are reporting the breach and notifying the right individuals as specified by HIPAA. In addition, the number of affected persons, your state’s individual reporting requirements, the types of PHI, and the likelihood the PHI exposed will be used for malicious intent will influence the best way to address the breach. All practices, before a breach ever occurs, should have a Breach Notification Policy in place that will outline the proper reporting steps that must be followed. Like all HIPAA policies, the policy should also include any state-specific breach notification laws that might supersede Federal requirements. It’s important to note that analyzing your HIPAA program shouldn’t only be done after a breach has already occurred. Practices should assess their level of HIPAA compliance regularly and complete the mandatory annual Security Risk Analysis in order to determine areas that could be breached in the future. This not only sheds light on often overlooked risks, such as outdated computer programs or missing policies for regulating access but in the circumstance that your practice does experience a breach you are better equipped to identify and mitigate the issue. In fact, if you experience a breach and have not completed the required Security Risk Analysis beforehand, the likelihood that your practice will be hit with a HIPAA fine goes up dramatically – almost all HIPAA fines levied by the OCR are in part the result of a missing risk analysis.  Updating and maintaining your practice-specific Security Risk Analysis and policies on a regular basis may seem daunting, but software solutions (like Abyde!) help streamline and automate this process to simplify your compliance program.