The U.S. Department of Health and Human Services Office for Civil Rights announced a settlement with Top of the World Ranch Treatment Center (TWRTC) in the amount of $103,000.
The HIPAA Security Rule requires administrative, physical, and technical safeguards to protect electronic PHI. The Risk Analysis standard requires organizations to assess risks and vulnerabilities to ePHI. Covered entities and business associates must comply with the Risk Analysis requirement.
Organizations must identify where ePHI is stored and transmitted to protect it properly. This is another example of why system wide risk analyses are so important.
OCR opened its investigation after TWRTC reported a breach in March 2023.
A phishing attack allowed an unauthorized party to access ePHI through an employee’s email account. The attack exposed the ePHI of 1,980 patients.
OCR determined that TWRTC failed to conduct an accurate and thorough risk analysis. This failure violated the HIPAA Security Rule.
TWRTC also agreed to implement a corrective action plan monitored for two years.
Under the corrective action plan, TWRTC must:
• Conduct and complete an accurate and thorough risk analysis to identify risks and vulnerabilities to ePHI.
• Develop and implement a risk management plan to address identified security risks and vulnerabilities.
• Create, maintain, and update written policies and procedures to comply with HIPAA Privacy, Security, and Breach Notification Rules.
• Employees serve as the first line of defense against cyber threats. Provide annual HIPAA training to workforce members who access ePHI.
Recommendations:
• Identify where ePHI is stored and how it enters, moves through, and exits your systems.
• Conduct regular risk analyses and update risk management measures to address identified vulnerabilities.
• Implement audit controls to record and examine system activity.
• Review system activity regularly to detect suspicious behavior.
• Use authentication mechanisms to verify users before granting access to ePHI.
• Encrypt ePHI in transit and at rest when appropriate to prevent unauthorized access.
• Incorporate lessons from security incidents into your security management process.
At Aris Medical Solutions, our online HIPAA Keeper™ is an all in one secure, cloud-based system that helps healthcare providers and business associates simplify compliance by maintaining their risk analyses, up-to-date policies, procedures, HIPAA training and documentation to meet every aspect of the HIPAA Privacy and Security Rules.
Protect your organization before an attack happens.
Schedule your HIPAA compliance review today and protect your organization from the next enforcement headline.
