Call Us Today! 877-659-2467 contactus@arismedicalsolutions.com
Aris Home
Contact Us
Learn More

Author: Suze Shaffer

Suze Shaffer is the Owner and President of Aris Medical Solutions, a healthcare compliance company dedicated to simplifying HIPAA compliance. Through its online compliance solution, the HIPAA Keeper™, Aris Medical Solutions provides healthcare providers and business associates with the tools, documentation, training, and expert guidance needed to achieve and maintain HIPAA compliance. Through the HIPAA Keeper™, Aris has assisted organizations nationwide with conducting risk analyses, developing risk management plans, implementing HIPAA Privacy and Security policies and procedures, and strengthening safeguards for protected health information. Aris Medical Solutions also considers applicable federal and state privacy and security requirements to help clients build a more comprehensive compliance program. Suze is also a speaker and has presented at numerous conferences and professional events on HIPAA compliance, cybersecurity, risk management, and data breach prevention. Helping organizations understand their responsibilities and identify vulnerabilities before they result in a breach, audit, or investigation. She believes effective compliance begins with education. By helping organizations understand not only what they are required to do, but why those safeguards are important, organizations are better prepared to protect patient information and reduce their compliance risks. At Aris Medical Solutions, the mission is simple: “Simplifying HIPAA” through education, expert guidance, and the HIPAA Keeper™, Aris Medical Solutions helps organizations turn complicated compliance requirements into a manageable, ongoing process. The information provided reflects regulatory requirements and guidance available at the time of writing and is intended for educational purposes only. It should not be considered legal advice.

$800,000 – OCR’s 22nd Ransomware Enforcement Action

Posted bySuze Shaffer

Lehigh Valley Health Network $800K

HHS’s Office for Civil Rights announced an $800,000 settlement with Lehigh Valley Health Network and affiliated entities. The settlement addresses potential violations of HIPAA’s Privacy, Security, and Breach Notification Rules. Lehigh Valley Health Network (LVHN) also agreed to implement a corrective action plan under three years of OCR monitoring.

Ransomware Exposed Sensitive Patient Information

The Pennsylvania health system discovered suspicious activity within its information systems on February 4, 2023. LVHN later determined that ransomware caused the incident and submitted a breach report on May 15, 2023. Attackers stole protected health information (PHI) and posted it on the dark web. The attack affected 248,359 individuals and exposed sensitive photographs of cancer patients receiving radiation oncology treatment.

The stolen information also included:

  • Names, addresses, and birth dates.
  • Social Security and driver’s license numbers.
  • Financial information.
  • Diagnoses, conditions, laboratory results, medications, and treatment information.

Potential Violations

The investigation identified potential violations involving risk analysis, activity reviews, unauthorized disclosures, and breach notifications.

OCR found that LVHN potentially failed to:

  • Thoroughly assess risks and vulnerabilities affecting the confidentiality, integrity, and availability of all electronic protected health information (ePHI).
  • Implement procedures for regularly reviewing audit logs, access reports, and security incident tracking reports.
  • Protect 248,359 individuals’ PHI from impermissible disclosure.
  • Notify affected individuals within required timeframes.
  • Notify the HHS Secretary within required timeframes.

Corrective Action Requires Documented Improvements

OCR will monitor LVHN’s corrective action plan for three years. LVHN must take these steps:

  • Conduct a thorough risk analysis covering risks and vulnerabilities to its ePHI’s confidentiality, integrity, and availability.
  • Develop and implement a risk management plan addressing identified security risks and vulnerabilities.
  • Review and revise Privacy, Security, and Breach Notification policies and procedures as necessary.
  • Review, develop, or revise HIPAA training materials to address workforce members’ job responsibilities.

Practical Steps to Reduce Cybersecurity Risks

OCR Director Paula M. Stannard emphasized that inadequate risk analyses and activity reviews leave organizations vulnerable to cyberattacks. She urged regulated organizations to fully implement the HIPAA Security Rule.

OCR enforces HIPAA requirements that protect PHI across covered entities and business associates. Covered entities include health plans, healthcare clearinghouses, and most healthcare providers.

OCR recommends that regulated organizations take these steps to prevent or reduce cyberthreats:

  • Identify every location where the organization maintains ePHI.
  • Map how ePHI enters, moves through, and leaves information systems.
  • Conduct periodic risk analyses and update them when necessary.
  • Develop and implement risk management plans addressing identified risks and vulnerabilities.
  • Establish audit controls that record information system activity and support examination.
  • Review information system activity regularly.
  • Implement authentication controls that restrict ePHI access to authorized users.
  • Encrypt ePHI during transmission and storage when appropriate.
  • Apply lessons from security incidents to the organization’s security management process.
  • Provide regular HIPAA training tailored to the organization and each workforce member’s responsibilities.

The Risk Analysis provision requires regulated organizations (covered entities and their business associates) to conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI held by that organization. Guidance about the HIPAA Privacy Rule, Security Rule, and Breach Notification Rule, and the Security Rule’s Risk Analysis requirement, can also be found on OCR’s website.

Review the resolution agreement and corrective action plan for additional details.

When was the last time your organization updated its HIPAA security risk analysis?

Aris Medical Solutions can help you identify compliance gaps and prevent costly data breaches.

Schedule your HIPAA compliance review today and protect your organization from the next enforcement headline.

Your Trusted Partner for HIPAA Compliance since 2009

Telemedicine Company Owner Sentenced to 20 Years

Posted bySuze Shaffer

A Florida telemedicine company owner received a 20-year prison sentence for orchestrating a $46.2 million Medicare fraud scheme.

Christopher Harwood, 44, of Fort Lauderdale, Florida, owned and operated TelevisitMD, a telemedicine company involved in fraudulent Medicare billing. The scheme operated for more than six years and involved unnecessary medical equipment, genetic testing, and fraudulent physician orders. In addition to his prison sentence, the court ordered Harwood to pay $17,942,402 in restitution to Medicare. The court also ordered him to forfeit $10,431,463 in proceeds from the fraudulent operation.

How the Medicare Fraud Scheme Worked

Harwood and his co-conspirators used aggressive telemarketing campaigns to target Medicare beneficiaries. Telemarketers persuaded patients to accept orthopedic braces and genetic tests they did not medically need. Harwood paid physicians to approve orders for these products and services without conducting legitimate medical evaluations.

Many physicians signed orders without establishing meaningful relationships with patients or following Medicare’s telemedicine requirements. Harwood then sold these signed orders to durable medical equipment (DME) suppliers, laboratories, and marketers participating in the scheme.

He also owned several Florida-based DME companies that submitted fraudulent Medicare claims for unnecessary orthopedic braces. In many cases, patients neither wanted nor needed the medical equipment billed to Medicare.

Millions in Fraudulent Medicare Claims

Investigators determined that Harwood’s operation generated $46.2 million in false and fraudulent Medicare claims. Medicare paid approximately $17.9 million on those claims. Harwood personally collected more than $10.4 million in profits from the fraudulent activities.

In March 2026, Harwood pleaded guilty to conspiracy to commit healthcare fraud and wire fraud. His conviction highlights the serious consequences of exploiting federal healthcare programs for financial gain.

Federal Agencies Investigated the Fraud

The FBI and the Department of Health and Human Services Office of Inspector General (HHS-OIG) investigated the case. The Department of Justice’s Health Care Fraud Section handled the prosecution. Federal authorities continue targeting fraudulent billing practices, unnecessary medical services, and illegal financial arrangements involving healthcare providers.

Federal Healthcare Fraud Enforcement Continues

The Department of Justice established its Fraud Division on April 7 to strengthen federal fraud investigations and prosecutions. The division supports broader federal efforts to identify fraud, waste, and abuse within government benefit programs. The Department of Justice also operates nine healthcare fraud strike forces across federal judicial districts.

Since 2007, these strike forces have charged more than 6,200 defendants. Those defendants collectively billed federal healthcare programs and private insurers more than $45 billion. The Centers for Medicare & Medicaid Services (CMS) also works with HHS-OIG to identify fraudulent activities and hold providers accountable.

What Healthcare Providers Can Learn From This Case

This case demonstrates the importance of proper medical documentation, legitimate patient evaluations, and accurate Medicare billing. Healthcare providers must establish medical necessity before ordering tests, equipment, or other services.

Physicians should never approve medical orders without completing the evaluations required by applicable Medicare rules. Medical practices should also monitor relationships with telemedicine companies, laboratories, marketers, and medical equipment suppliers.

Strong compliance programs help identify suspicious billing practices, prevent fraud, and protect the integrity of patient care.

Healthcare organizations should regularly review billing procedures, physician documentation, and vendor relationships to identify potential compliance risks.

Fraud prevention requires more than written policies. It requires ongoing oversight, employee education, and accountability.

At Aris Medical Solutions, our HIPAA Keeper™ cloud-based platform makes HIPAA compliance simple. It guides your organization through every requirement with a clear, step-by-step process. From risk analyses, risk management, policies to employee training and required documentation, you’ll have everything needed to remain compliant, protected, and audit-ready. Best of all, your HIPAA Compliance Officer is never on their own. Every client has access to a Certified HIPAA Security Analyst who provides expert guidance, answers questions, and helps ensure your compliance program is implemented correctly.

HIPAA Keeper Logo

Schedule your HIPAA compliance review today and protect your organization from the next enforcement headline.

Your Trusted Partner for HIPAA Compliance since 2009

Source: U.S. Department of Justice, Health Care Fraud Strike Force Program

https://www.justice.gov/criminal-fraud/health-care-fraud-unit

Small Dental Practice Faces $140,000 HIPAA Settlement

Posted bySuze Shaffer

A patient records complaint led to a costly HIPAA settlement for a solo dental practice in Pennsylvania.

The Office for Civil Rights (OCR) settled a HIPAA investigation involving Shen Smiles, a Pennsylvania dental practice. The investigation began after a former patient repeatedly requested medical records without receiving them.

During the investigation, the practice reportedly told OCR that a workforce member had taken the records.

However, OCR uncovered additional concerns involving patient privacy, record security, and HIPAA compliance.

OCR Identified Multiple HIPAA Compliance Failures

According to OCR, the practice failed to demonstrate several basic HIPAA safeguards, including:

  • Written HIPAA Privacy and Breach Notification policies.
  • Documented patient right-of-access procedures.
  • Reasonable physical safeguards to protect paper records.
  • Formal HIPAA Privacy Rule training for employees.

OCR also identified serious concerns about how the practice stored and transported patient records.

The practice reportedly stored patient records in unsecured boxes throughout the office. Locations included a hygienist’s office, the floor, and a private bathroom.

Staff also transported records between offices and the dentist’s home. In some cases, records were missing when patients arrived for appointments.

These findings demonstrate how poor record management can expose patient information and create significant compliance risks.

Why This Settlement Matters to Small Practices

HIPAA applies to covered healthcare providers regardless of practice size.

Solo practitioners and small dental offices must follow the same applicable HIPAA Privacy and Security Rule requirements as larger organizations.

Practices that use paper records, operate multiple locations, or store records off-site face additional challenges.

Without documented procedures and appropriate safeguards, these practices increase their exposure to complaints, investigations, and potential penalties.

Steps Every Medical and Dental Practice Should Take

Healthcare organizations should review their HIPAA compliance programs and address potential gaps immediately.

  • Review HIPAA policies. Maintain written Privacy, Breach Notification, and patient right-of-access procedures.
  • Secure patient records. Store paper records in locked areas with appropriate access controls.
  • Control record transportation. Establish procedures for moving records between locations and prohibit unauthorized home storage.
  • Track record movement. Maintain logs documenting who removes records, their destination, and their return.
  • Monitor patient requests. Track access requests and meet HIPAA’s 30-day response deadline, subject to permitted extensions.
  • Document employee training. Train workforce members on applicable HIPAA policies and maintain training records.
  • Prepare for security incidents. Establish procedures for missing records, suspected theft, breach assessments, workforce sanctions, and required notifications.
  • Maintain compliance documentation. Keep policies, training records, and supporting documentation readily available for OCR investigations.

The Bottom Line: Small Practices Are Not Exempt

This settlement did not introduce new HIPAA requirements or include a corrective action plan. The agreement also does not constitute an admission of liability.

However, OCR’s six-figure settlement sends an important message to healthcare providers.

Even a solo dental practice can face significant financial consequences for failing to demonstrate basic HIPAA compliance.

HIPAA compliance requires more than written policies. Practices must implement safeguards, train employees, maintain documentation, and regularly evaluate their compliance programs.

If your practice cannot demonstrate its compliance efforts, an OCR investigation could expose costly gaps.

Protect Your Organization Before It’s Too Late

Aris Medical Solutions helps medical and dental practices identify compliance gaps and implement effective HIPAA safeguards. Our HIPAA Keeper™ compliance system simplifies documentation, risk management, employee training, and ongoing compliance.

Contact Aris Medical Solutions for a complimentary HIPAA compliance consultation.

Schedule your HIPAA compliance review today and protect your organization from the next enforcement headline

Sources

OSF HealthCare Pays $552,250 to Settle HIPAA Investigation

Posted bySuze Shaffer

OSF HealthCare System and its Affiliated Covered Entities (OSF HealthCare) agreed to pay $552,250 to resolve potential HIPAA violations. OSF is headquartered in Illinois and operates healthcare facilities in Illinois and Michigan. The OCR will monitor the organization under a corrective action plan for two years.

The Office for Civil Rights (OCR) enforces HIPAA Privacy, Security, and Breach Notification Rules. These rules require covered entities and business associates to protect the privacy and security of protected health information (PHI) and electronic protected health information (ePHI).

The enforcement action serves as another reminder that OCR expects organizations to maintain an accurate risk analysis and an effective risk management program.

OCR Director

OCR Director Paula M. Stannard emphasized the importance of conducting a thorough HIPAA risk analysis.

She stated, “An accurate and thorough HIPAA risk analysis is required by law. It also helps protect health information and reduce ransomware risks. Organizations that fail to identify vulnerabilities often discover them only after an attack.”

When did this Start?

OCR opened its investigation after OSF reported a data breach in October 2021.

In April 2021, OSF discovered that attackers had infected their systems with the Nephilim ransomware variant. The attackers exfiltrated the PHI of 53,907 individuals.

The compromised information included driver’s license numbers, diagnoses, treatment records, prescription information, medical record numbers, provider names, service dates, financial account information, and health insurance information.

Potential HIPAA Violations

OCR identified several potential HIPAA violations. OSF allegedly failed to conduct an accurate and thorough risk analysis. The organization impermissibly disclosed the PHI of 53,907 individuals. OSF also failed to notify affected individuals within the required timeframe. In addition, OSF did not provide timely breach notification to the Secretary of Health and Human Services.

The Aftermath

Under the resolution agreement, OSF will implement a corrective action plan for two years. The organization also paid $552,250 to OCR. The corrective action plan requires OSF to strengthen its HIPAA compliance program. OSF must conduct a comprehensive risk analysis. The analysis must identify risks to the confidentiality, integrity, and availability of ePHI. OSF must also develop and implement a risk management plan. The plan must address and reduce identified security risks and vulnerabilities.

Recommendations

OCR recommends several cybersecurity practices for covered entities and business associates.

  • Identify where ePHI is stored and how it enters, moves through, and leaves your systems.
  • Conduct and update risk analyses regularly.
  • Develop and maintain a risk management plan.
  • Implement audit controls to record and review system activity.
  • Review information system activity on a regular basis.
  • Verify user identities before granting access to ePHI.
  • Encrypt ePHI during transmission and while stored whenever appropriate.
  • Apply lessons learned from security incidents to improve security programs.
  • Provide regular HIPAA training that reflects employee responsibilities.

The HIPAA Rules

The HIPAA Privacy Rule establishes national standards for protecting PHI. It also limits how organizations use and disclose PHI. The rule gives individuals important rights, including timely access to their health records.

The HIPAA Security Rule requires administrative, physical, and technical safeguards. These safeguards protect the confidentiality, integrity, and availability of ePHI. The Security Rule also requires organizations to perform accurate and thorough risk analyses.

The HIPAA Breach Notification Rule requires covered entities and business associates to notify affected parties after a breach of unsecured PHI.

OCR continues to enforce the HIPAA Rules to protect patient information.

Protect Your Organization Before It’s Too Late

HIPAA compliance isn’t a one-time project. It’s an ongoing process. At Aris Medical Solutions, our HIPAA Keeper™ system simplifies compliance with a cloud-based platform that walks you through each requirement, step by step. From risk analysis to training and documentation, you’ll have everything you need to stay protected, compliant, and audit ready.

Protect your practice — and your patients.

Schedule your HIPAA compliance review today and protect your organization from the next enforcement headline.

Drug & Alcohol Treatment Services Ransomware Settlement

Posted bySuze Shaffer

HIPAA Compliance Lessons for Healthcare Providers

Healthcare organizations continue to face an unprecedented wave of ransomware attacks, and the financial consequences extend well beyond regulatory penalties.

The latest example involves Drug and Alcohol Treatment Services, Inc. (DATS), an addiction treatment provider based in Scranton, Pennsylvania. The organization has agreed to settle multiple class action lawsuits arising from an October 2024 ransomware attack that compromised sensitive patient information.

While every healthcare breach has unique circumstances, this case reinforces a lesson every covered entity and business associate should understand:

HIPAA compliance is no longer just about policies and employee training—it must include a comprehensive cybersecurity program.

What Happened?

According to public reports, cybercriminals gained unauthorized access to DATS’ network between October 5 and October 6, 2024. Following its investigation, the organization determined that both protected health information (PHI) and personally identifiable information (PII) had been compromised. The breach affected approximately 22,215 individuals.

The Cost of a Breach is just the beginning

The ransomware attack resulted in far more than the technical challenges of restoring systems and investigating the incident.

According to public reports, multiple lawsuits were consolidated into a single class action, culminating in a proposed $549,000 settlement. As part of the settlement, DATS also agreed to maintain and strengthen its information security program for a period of five years, reinforcing the long-term operational and financial impact that a data breach can have on a healthcare organization.

Often, the long-term business impact exceeds the initial ransomware event.

Why OCR Looks Beyond the Attack

One of the biggest misconceptions in healthcare is that organizations are fined simply because they were hacked.

That is not how HIPAA enforcement typically works.

The HHS Office for Civil Rights (OCR) generally evaluates whether the organization had implemented the reasonable and appropriate safeguards required by the HIPAA Security Rule before the attack occurred.

OCR commonly reviews whether an organization had:

  • Conducted an enterprise-wide security risk analysis
  • Implemented a documented risk management plan
  • Maintained current HIPAA policies and procedures
  • Provided workforce HIPAA training
  • Managed vendor and Business Associate Agreements
  • Maintained incident response procedures
  • Reviewed audit logs and system activity
  • Implemented strong access controls
  • Used multi-factor authentication where appropriate
  • Protected systems with encryption and backups

Organizations that cannot demonstrate these safeguards often face much greater regulatory scrutiny following a breach.

Behavioral Health Organizations Face Higher Privacy Risks

For an addiction treatment provider, the exposure of this type of information is especially concerning because it includes records related to behavioral health and substance use disorder (SUD) treatment. In addition to HIPAA, many SUD treatment records are subject to the heightened confidentiality requirements of 42 CFR Part 2, which imposes stricter protections on the use and disclosure of patient information. A breach involving these records can have significant legal, financial, and reputational consequences, making robust cybersecurity and privacy safeguards essential.

Organizations providing behavioral health, psychiatric, addiction treatment, and substance use services often maintain some of the most sensitive healthcare records.

A ransomware attack affecting these organizations may expose information that patients consider deeply personal, increasing both legal exposure and reputational harm.

Because of the sensitive nature of behavioral health records, providers should regularly review both their HIPAA compliance program and applicable federal and state privacy requirements.

Lessons Every Healthcare Organization Should Learn

Every ransomware incident should prompt healthcare organizations to ask:

  • When was our last Security Risk Analysis?
  • Have we documented how risks are being addressed?
  • Are employees receiving annual HIPAA and cybersecurity training?
  • Are our Business Associate Agreements current?
  • Do we test our incident response and contingency plans?
  • Could we demonstrate compliance during an OCR investigation?

If the answer to any of these questions is “I’m not sure,” now is the time to act, not after a cyberattack.

Summary

The DATS settlement is another reminder that ransomware is no longer a question of if, but when.

Healthcare organizations that invest in both cybersecurity and documented HIPAA compliance place themselves in a much stronger position to protect patients, respond effectively to incidents, and demonstrate compliance if regulators come calling. Thus, protecting them from potential class action lawsuits.

As OCR frequently reminds covered entities, documentation matters.

If it’s not documented, it may be difficult to prove it was ever done.

How the HIPAA Keeper™ Helps

The HIPAA Keeper™ was designed to help healthcare organizations build and maintain a documented compliance program that supports the requirements of the HIPAA Privacy Rule and Security Rule.

The platform helps organizations:

  • Complete annual Security Risk Analyses
  • Develop Risk Management Plans
  • Maintain required HIPAA documentation
  • Train employees
  • Track Business Associate Agreements
  • Document compliance activities
  • Prepare for OCR audits
  • Stay organized throughout the year

Cybersecurity tools help prevent attacks. HIPAA compliance helps demonstrate that your organization took reasonable steps to protect patient information before an attack occurred.

Both are essential.

Don’t leave patient data exposed.

At Aris Medical Solutions, our online HIPAA Keeper™ system helps healthcare providers and business associates maintain full compliance.


Schedule your HIPAA Risk Analysis and Access Control Review with Aris Medical Solutions today.

Class Action Lawsuits against Medical Practices

Posted bySuze Shaffer

Patients assume medical practices automatically protect their information

Many patients assume their medical information is automatically protected simply because they are visiting a healthcare provider. However, when a medical practice is not fully compliant with HIPAA requirements, sensitive personal and health information may be at greater risk of unauthorized access, disclosure, theft, or misuse. This can include Social Security numbers, insurance information, medical histories, diagnoses, prescriptions, and financial information.

What does Non-Compliance Mean

Non-HIPAA compliant practices may fail to properly secure computer systems, train employees, monitor access to records, or implement safeguards against cyberattacks and ransomware. As a result, patient information may be exposed through hacking incidents, lost devices, employee mistakes, improper conversations, or unsecured email and texting systems. Once information is compromised, patients may face identity theft, medical fraud, insurance fraud, embarrassment, or loss of privacy.

HIPAA is not a once and done process

HIPAA compliance is not just about avoiding government fines. It is about protecting patient trust, confidentiality, and safety. Patients should feel comfortable asking their healthcare provider how their information is protected, whether staff receive HIPAA training, and what safeguards are in place to help prevent data breaches and unauthorized disclosures.

Private Right of Action

HIPAA itself does not provide individuals with a “private right of action,” meaning patients generally cannot sue a Covered Entity or Business Associate directly under HIPAA for a violation. Enforcement authority belongs to the U.S. Department of Health and Human Services Office for Civil Rights (OCR), which investigates complaints and may impose corrective actions, settlements, or civil monetary penalties.

Class Action Lawsuits

However, while patients may not sue “under HIPAA,” class action lawsuits are becoming more prevalent following healthcare data breaches or privacy incidents. Plaintiffs’ attorneys often use alleged HIPAA failures as evidence of negligence, inadequate security practices, breach of fiduciary duty, or violations of state consumer protection and privacy laws. In many cases, lawsuits focus on claims such as emotional distress, identity theft risk, financial harm, or failure to properly safeguard sensitive information. As healthcare breaches continue to increase and state privacy laws expand, organizations are facing growing litigation exposure even when OCR does not issue a HIPAA fine.

Protect Your Organization Before It’s Too Late

HIPAA compliance isn’t a one-time project. It’s an ongoing process. At Aris Medical Solutions, our HIPAA Keeper™ system simplifies compliance with a cloud-based platform that walks you through each requirement, step by step. From risk analysis to training and documentation, you’ll have everything you need to stay protected, compliant, and audit ready.

Protect your practice — and your patients.

Schedule your HIPAA compliance review today and protect your organization from the next enforcement headline.

Top of the World Ranch Treatment Center Settles with OCR

Posted bySuze Shaffer

The U.S. Department of Health and Human Services Office for Civil Rights announced a settlement with Top of the World Ranch Treatment Center (TWRTC) in the amount of $103,000.

The HIPAA Security Rule requires administrative, physical, and technical safeguards to protect electronic PHI. The Risk Analysis standard requires organizations to assess risks and vulnerabilities to ePHI. Covered entities and business associates must comply with the Risk Analysis requirement.

Organizations must identify where ePHI is stored and transmitted to protect it properly. This is another example of why system wide risk analyses are so important.


OCR opened its investigation after TWRTC reported a breach in March 2023.
A phishing attack allowed an unauthorized party to access ePHI through an employee’s email account. The attack exposed the ePHI of 1,980 patients.

OCR determined that TWRTC failed to conduct an accurate and thorough risk analysis. This failure violated the HIPAA Security Rule.

TWRTC also agreed to implement a corrective action plan monitored for two years.

Under the corrective action plan, TWRTC must:

• Conduct and complete an accurate and thorough risk analysis to identify risks and vulnerabilities to ePHI.

• Develop and implement a risk management plan to address identified security risks and vulnerabilities.

• Create, maintain, and update written policies and procedures to comply with HIPAA Privacy, Security, and Breach Notification Rules.

• Employees serve as the first line of defense against cyber threats. Provide annual HIPAA training to workforce members who access ePHI.

Recommendations:

• Identify where ePHI is stored and how it enters, moves through, and exits your systems.

• Conduct regular risk analyses and update risk management measures to address identified vulnerabilities.

• Implement audit controls to record and examine system activity.

• Review system activity regularly to detect suspicious behavior.

• Use authentication mechanisms to verify users before granting access to ePHI.

• Encrypt ePHI in transit and at rest when appropriate to prevent unauthorized access.

• Incorporate lessons from security incidents into your security management process.

At Aris Medical Solutions, our online HIPAA Keeper™ is an all in one secure, cloud-based system that helps healthcare providers and business associates simplify compliance by maintaining their risk analyses, up-to-date policies, procedures, HIPAA training and documentation to meet every aspect of the HIPAA Privacy and Security Rules.

Protect your organization before an attack happens.

Schedule your HIPAA compliance review today and protect your organization from the next enforcement headline.

Cadia Healthcare Facilities fined $182K for posting success stories

Posted bySuze Shaffer

OCR issues fines for not obtaining written authorizations before sharing PHI

The Cadia Healthcare Facilities are rehabilitation, skilled nursing, and long-term care services providers located in Delaware and were fined $182K for “posting” a success story to their website without obtaining a written authorization from the patient.

The settlement resolves an investigation of Cadia Healthcare Facilities that OCR initiated after receiving a complaint in September 2021 alleging that Cadia Healthcare Facilities had impermissibly disclosed a patient’s name, photograph and information pertaining to the patient’s conditions, treatment, and recovery in the form of a “success story” posted to Cadia Healthcare Facilities’ website.

Additional disclosures

OCR’s investigation also determined that Cadia Healthcare Facilities disclosed the PHI of a total of 150 patients to its websites through its “success story” program without first obtaining valid, written HIPAA authorizations. OCR determined that Cadia Healthcare Facilities impermissibly disclosed PHI, failed to have appropriate administrative, physical, and technical safeguards in place to protect the privacy of PHI, and failed to provide breach notification to the affected individuals.

Under the resolution agreement

Under the terms of the resolution agreement, Cadia Healthcare Facilities agreed to implement a corrective action plan that will be monitored by OCR for two years and pay $182,000 to the OCR. Cadia Healthcare Facilities will also take steps to improve its compliance with the HIPAA Privacy and Breach Notification Rules.

This includes:

  • Developing, reviewing, maintaining, and/or revising, its written policies and procedures to comply with the HIPAA Privacy and Breach Notification Rules.
  • Providing training on their HIPAA policies and procedures to all members of their workforce, including marketing personnel.
  • Cadia Healthcare facilities must notify any individuals (or their personal representatives) whose PHI was disclosed without valid authorization on websites, social media platforms, or in any other marketing materials.

Summary

“The internet and social media are important business development tools.  But before disclosing PHI through social media or public-facing websites, covered entities and business associates should ensure that the HIPAA Privacy Rule permits the disclosure,” said OCR Director Paula M. Stannard. “Generally, a valid, written HIPAA authorization from an individual is necessary before a covered entity or business associate can post that individual’s PHI in a website testimonial or through a social media campaign.”

This case is a clear warning to ensure all employees, including marketing individuals, are included in HIPAA training and policies and procedures are implemented and followed.

At Aris Medical Solutions, our HIPAA Keeper™ platform helps healthcare organizations get compliant and maintain compliance with the HIPAA Privacy and Security Rules—all within one secure, cloud-based system.

Contact Aris to schedule a free HIPAA checkup today.

BST & Co. CPAs, LLP fined $175K for Ransomware Breach

Posted bySuze Shaffer

OCR Issues 15th Ransomware Enforcement Action and 10th Enforcement Action in Risk Analysis Initiative

The U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR) announced a settlement with BST & Co. CPAs, LLP (“BST”), a New York-based public accounting, business advisory, and management consulting firm, for potential violations of the HIPAA Security Rule. As a business associate, BST received financial data containing protected health information (PHI) from a HIPAA covered entity.

OCR enforces the HIPAA Privacy, Security, and Breach Notification Rules

This require covered entities (health plans, health care clearinghouses, and most providers) and business associates like BST to safeguard PHI. The HIPAA Security Rule establishes national standards that protect ePHI through administrative, physical, and technical safeguards. Its Risk Analysis provision requires regulated entities to conduct accurate and thorough assessments of risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI.

“OCR considers a HIPAA risk analysis essential for locating ePHI and determining what security measures are needed to protect it,”

As quoted by OCR Director Paula M. Stannard. “Conducting a thorough risk analysis that drives a risk management plan serves as a foundation for preventing or mitigating cyberattacks and breaches.”

OCR launched its investigation after BST filed a breach report on February 16, 2020. BST reported that on December 7, 2019, it discovered ransomware on part of its network that affected PHI belonging to a covered entity client. Investigators determined that BST had failed to conduct an accurate and thorough risk analysis of its ePHI environment.

Under the resolution agreement

BST agreed to pay $175,000, implement a corrective action plan monitored by OCR for two years, and strengthen its HIPAA Security Rule compliance. BST must:

  • Conduct a thorough risk analysis of its ePHI environment;
  • Develop and implement a risk management plan to address identified risks;
  • Maintain and revise written HIPAA Privacy and Security Rule policies and procedures; and
  • Expand HIPAA and security training, including annual training for workforce members with PHI access.

OCR urged all covered entities and business associates to reduce cyber threats by:

  • Identifying where ePHI resides and how it flows across systems;
  • Performing and updating risk analyses, and implementing risk management measures;
  • Maintaining audit controls and reviewing system activity;
  • Authenticating user access and encrypting ePHI in transit and at rest;
  • Incorporating lessons learned from incidents into security management; and
  • Delivering workforce training tailored to organizational roles and responsibilities.

This case is a clear warning: even trusted professional firms can face HIPAA penalties if they overlook basic security requirements. A thorough risk analysis and an active risk management plan are not just regulatory obligations, they’re essential safeguards for protecting patient data and maintaining client trust.

At Aris Medical Solutions, our HIPAA Keeper™ platform helps healthcare organizations perform a complete risk analysis, implement risk management strategies, and maintain ongoing compliance with the HIPAA Privacy and Security Rules – all within one secure, cloud-based system.

Don’t wait for an OCR complaint to expose your weaknesses, schedule your annual HIPAA Risk Analysis today.

Syracuse ASC fined $250K for Ransomware

Posted bySuze Shaffer

A Costly Reminder of HIPAA’s Ransomware Readiness Requirements. The U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR), announced a settlement with Syracuse ASC, LLC, doing business as Specialty Surgery Center of Central New York, for potential violations of the HIPAA Security and Breach Notification Rules. This case marks OCR’s 14th ransomware enforcement action, reinforcing the growing federal focus on cybersecurity preparedness across the healthcare sector.

History

Syracuse ASC is a single-facility ambulatory surgery center in Liverpool, New York, specializing in ophthalmic, ENT, and pain management procedures. In March 2021, the center experienced a ransomware attack involving the PYSA variant—a sophisticated cross-platform malware known for targeting healthcare organizations.

The incident compromised electronic protected health information (ePHI) for 24,891 individuals. OCR initiated an investigation in October 2021 after Syracuse ASC reported the breach to HHS. The investigation revealed that the center had never conducted an accurate and thorough HIPAA risk analysis, as required by the Security Rule. OCR also found that Syracuse ASC failed to provide timely breach notifications to both affected individuals and HHS.

Settlement Terms

Under the Resolution Agreement, Syracuse ASC agreed to:

  • Pay $250,000 to HHS OCR.
  • Implement a Corrective Action Plan (CAP) monitored for two years.

The CAP requires Syracuse ASC to:

  • Conduct a complete and thorough risk analysis of ePHI systems.
  • Develop and implement a risk management plan to address identified vulnerabilities.
  • Review and revise policies and procedures to ensure compliance with HIPAA.
  • Provide annual HIPAA training for all workforce members handling PHI.

OCR’s Message: Ransomware Risks Are Real

OCR Director Paula M. Stannard stressed the critical importance of proactive cybersecurity, stating:

“Conducting a thorough HIPAA-compliant risk analysis—and developing and implementing risk management measures to address identified risks and vulnerabilities—is even more necessary as sophisticated cyberattacks increase. HIPAA covered entities and business associates make themselves soft targets for cyberattacks if they fail to implement the HIPAA Security Rule requirements.”

This case underscores that failing to complete and document a proper risk analysis not only weakens an organization’s defenses but also constitutes a direct violation of the HIPAA Security Rule.

The Role of the Breach Notification Rule

In addition to security failures, OCR determined that Syracuse ASC violated the HIPAA Breach Notification Rule, which requires covered entities and their business associates to:

  • Notify affected individuals without unreasonable delay (no later than 60 days after discovery).
  • Report the breach to HHS within the same timeframe.
  • Document the scope, cause, and mitigation actions taken.

Delayed notification denies patients their right to act quickly to protect their personal and financial information and signals poor incident response readiness.

OCR’s Recommendations for Preventing Cyber Threats

To help prevent or mitigate ransomware and other cyber threats, OCR recommends that all healthcare entities and business associates:

  • Identify where ePHI is stored, transmitted, and processed across all systems.
  • Conduct and regularly update risk analyses.
  • Implement and maintain a risk management plan addressing identified threats.
  • Establish audit controls to monitor system activity.
  • Authenticate all users accessing ePHI.
  • Encrypt ePHI both at rest and in transit.
  • Incorporate lessons learned from past incidents into the security program.
  • Provide ongoing, role-specific HIPAA training for all staff.

Summary

Ransomware attacks are no longer rare events – they’re a daily threat to healthcare organizations of all sizes. OCR’s 14th ransomware enforcement action makes one thing clear: a missing or incomplete risk analysis is a direct pathway to vulnerability and liability.

Every covered entity and business associate must have a documented risk analysis and risk management plan. This is not just for compliance, but to protect patients, data, and the integrity of their operations.

At Aris Medical Solutions, our online HIPAA Keeper™ is an all in one secure, cloud-based system that helps healthcare providers and business associates simplify compliance by maintaining up-to-date policies, procedures, HIPAA training and documentation to meet every aspect of the HIPAA Privacy and Security Rules.

Protect your practice before an attack happens. Schedule your HIPAA compliance review today and protect your organization from the next enforcement headline.

©2026 Aris Medical Solutions – HIPAA Keeper | HIPAA Compliance Consultants | All Rights Reserved | Terms and Conditions | Privacy Policy
The content and images on this website is owned by Aris Medical Solutions and their owners. Do not copy any content or images without our consent.
Powered by Bandwise LLC