OCR Issues 15th Ransomware Enforcement Action and 10th Enforcement Action in Risk Analysis Initiative
The U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR) announced a settlement with BST & Co. CPAs, LLP (“BST”), a New York-based public accounting, business advisory, and management consulting firm, for potential violations of the HIPAA Security Rule. As a business associate, BST received financial data containing protected health information (PHI) from a HIPAA covered entity.
OCR enforces the HIPAA Privacy, Security, and Breach Notification Rules
This require covered entities (health plans, health care clearinghouses, and most providers) and business associates like BST to safeguard PHI. The HIPAA Security Rule establishes national standards that protect ePHI through administrative, physical, and technical safeguards. Its Risk Analysis provision requires regulated entities to conduct accurate and thorough assessments of risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI.
“OCR considers a HIPAA risk analysis essential for locating ePHI and determining what security measures are needed to protect it,”
As quoted by OCR Director Paula M. Stannard. “Conducting a thorough risk analysis that drives a risk management plan serves as a foundation for preventing or mitigating cyberattacks and breaches.”
OCR launched its investigation after BST filed a breach report on February 16, 2020. BST reported that on December 7, 2019, it discovered ransomware on part of its network that affected PHI belonging to a covered entity client. Investigators determined that BST had failed to conduct an accurate and thorough risk analysis of its ePHI environment.
Under the resolution agreement
BST agreed to pay $175,000, implement a corrective action plan monitored by OCR for two years, and strengthen its HIPAA Security Rule compliance. BST must:
- Conduct a thorough risk analysis of its ePHI environment;
- Develop and implement a risk management plan to address identified risks;
- Maintain and revise written HIPAA Privacy and Security Rule policies and procedures; and
- Expand HIPAA and security training, including annual training for workforce members with PHI access.
OCR urged all covered entities and business associates to reduce cyber threats by:
- Identifying where ePHI resides and how it flows across systems;
- Performing and updating risk analyses, and implementing risk management measures;
- Maintaining audit controls and reviewing system activity;
- Authenticating user access and encrypting ePHI in transit and at rest;
- Incorporating lessons learned from incidents into security management; and
- Delivering workforce training tailored to organizational roles and responsibilities.
This case is a clear warning: even trusted professional firms can face HIPAA penalties if they overlook basic security requirements. A thorough risk analysis and an active risk management plan are not just regulatory obligations, they’re essential safeguards for protecting patient data and maintaining client trust.
At Aris Medical Solutions, our HIPAA Keeper™ platform helps healthcare organizations perform a complete risk analysis, implement risk management strategies, and maintain ongoing compliance with the HIPAA Privacy and Security Rules – all within one secure, cloud-based system.
Don’t wait for an OCR complaint to expose your weaknesses, schedule your annual HIPAA Risk Analysis today.
