At Least 365K Patients Impacted by Magellan Health Ransomware Attack
In April 2020, the Fortune 500 firm Magellan Health experienced a ransomware attack that resulted in [...]
Articles by HIPAA guide
GDPR Evaluation Report Hails GDPR a Success, But More Work Required
The European Commission, the executive body of the European Union, has published its first GDPR evaluation [...]
Telehealth Policy Changes Could Become Permanent When COVID-19 Public Health Emergency Ends
If there is one good thing to come out of the COVID-19 pandemic it is the changes that have been made to [...]
Reports of COVID-19 Diagnoses by Media Suggest Violations of HIPAA
When famous people are diagnosed with an illness or suffer an accident, that can be headline news. The Health [...]
Episcopal Health Services Data Breach Lawsuit Sent Back to State Court for Further Proceedings
A lawsuit filed against Episcopal Health Services following a phishing attack that exposed the protected [...]
Hungarian Data Protection Authority Issues Record-Breaking GDPR Fine
The Hungarian Data Protection Authority (NAIH) has imposed a record-breaking financial penalty under the [...]
Hungary Suspends Data Subjects’ Rights Under GDPR During COVID-19 Pandemic
The government in Hungary has taken the controversial decision to suspend the rights of data subjects under [...]
OCR Issues Guidance on Contacting Former COVID-19 Patients About Blood and Plasma Donations
The Department of Health and Human Services’ Office for Civil Rights has issued new HIPAA guidance to clear [...]
Guidance Issued by HSCC and H-ISAC on Managing the Cybersecurity Tactical Response During a Pandemic
Joint guidance on managing the cybersecurity tactical response has recently been published by the Healthcare [...]
PHI of 170,000 Patients Potentially Compromised in Recent Phishing Attacks
Monthly breach reports show that email is the most common location of breached protected health information. [...]
FTC Seeks Feedback on the Health Data Breach Notification Rule
The Federal Trade Commission is seeking feedback from healthcare industry stakeholders about its breach [...]
Dutch DPA Issues €750,000 GDPR Fine for Improper Use of Biometric Data
The Data Protection Authority in the Netherlands has imposed a financial penalty of €725,000 ($791,000) on [...]
CISA and NCSC Issue Joint Cybersecurity Alert About Ongoing Cyberattacks on Healthcare Organizations
Advanced Persistent Threat (APT) groups are continuing to exploit the SARS-CoV-2 (COVID-19) pandemic and are [...]
Film Crews Not Permitted in Hospitals Unless HIPAA Authorizations are Obtained from Patients, Warns OCR
Hospitals have been warned that they must not allow film crews into parts of hospitals where there is [...]
HHS Delays Enforcement of Information Sharing and Interoperability Rules
The new interoperability and data sharing rules that were announced by the HHS on March 9, 2020 were due to [...]
HHS Issues Notice of Enforcement Discretion for COVID-19 Community-Based Testing Sites
The Department of Health and Human Services’ Office for Civil Rights (OCR) has issued a Notice of [...]
Brave Software Inc. Files Complaint Over Alleged Google GDPR Violation
Brave Software Inc., developer of the Brave web browser, has filed a GDPR compliant with the Irish Data [...]
FBI Warns About COVID-19 Cyberattacks and Healthcare Providers Targeted by Individuals Posing as OCR Investigators
The Federal Bureau of Investigation (FBI) has issued a fresh warning about the use of the 2019 Novel [...]
OCR Announces Enforcement Discretion for Business Associate Uses and Disclosure of PHI
On April 2, 2020, the Department of Health and Human Services’ Office for Civil Rights (OCR) issued another [...]
COVID-19 and HIPAA Guidance on Disclosures of PHI to First Responders
The HHS’ Office for Civil Rights has issued guidance on COVID-19 and HIPAA about the permitted disclosures [...]
OCR Issues Guidance on Telehealth Services During COVID-19 Public Health Emergency
Last week, the Trump Administration extended Medicare telehealth services as the COVID-19 crisis deepened. [...]
2019 Novel Coronavirus and HIPAA Compliance
Important information on the 2019 Novel Coronavirus and HIPAA compliance, the limited HIPAA waiver announced [...]
Google Fined $8 Million by Swedish Data Protection Authority
The Swedish Data Protection Authority has announced it has imposed a SEK 75 million fine on Google for right [...]
HHS Publishes Final Interoperability, Information Blocking, and Data Sharing Rules
The U.S. Department of Health and Human Services has released its final interoperability, information [...]
Medical Devices Affected by SweynTooth Vulnerabilities, Warns FDA, CISA
The U.S. Food and Drug Administration (FDA) and the Department of Homeland Security’s Cybersecurity [...]
$100,000 HIPAA Fine Imposed on Physician Practice for Security Rule Violations
A $100,000 HIPAA fine has been imposed on a solo physician practice for HIPAA Security Rule failures [...]
Analysis of 2019 Healthcare Data Breaches
A recent analysis of 2019 healthcare data breaches by Protenus has confirmed that 2019 was a particularly bad [...]
Widespread E1 Transactions Violations Discovered by HHS’ Office of Inspector General
A recent audit of a mail-order pharmacy and 29 other healthcare provides by the Department of Health and [...]
HIPAA Email Retention Policy
While email retention is not specifically mentioned in the HIPAA text, certain provisions cover data [...]
HHS Modifies Pharmacy HIPAA Transaction Requirements for Partially Filled Schedule II Drug Prescriptions
The Department of Health and Human Services (HHS) has issued a final rule modifying the pharmacy HIPAA [...]
Irish DPC Launches GDPR Compliance Investigations into Google and Tinder
The Data Protection Commission in Ireland, the country’s lead GDPR regulator, has launched investigations [...]
Fee Limitations on Requests to Send Patient Records to Third Parties Lifted
Following a ruling in a federal court that went against the U.S. Department of Health and Human Services, the [...]
HIPAA Subpoena for Medical Records: What You Need to Know
A HIPAA subpoena for medical records is an area where there is considerable potential for a HIPAA violation. [...]
HIPAA Compliant Website Requirements
What are the requirements for a HIPAA compliant website? Here we list the important elements when setting up [...]
Immediately Patch Windows Vulnerabilities Warns DHS and OCR
On January 14, 2020 Microsoft issued patches to correct critical vulnerabilities in Windows and Windows [...]
What is the HIPAA “Minimum Necessary” Standard?
The HIPAA “Minimum Necessary” standard is an important provision of HIPAA and one that all healthcare [...]
London Pharmacy Hit With £275,000 GDPR Penalty
The Information Commissioner’s Office (ICO), the UK’s GDPR data protection authority, has issued its [...]
HIPAA Compliance Failures Result in $65,000 Fine for Georgia Ambulance Company
West Georgia Ambulance, Inc., an ambulance company serving Carroll County in Georgia, has agreed to settle a [...]
Is Office 365 HIPAA Compliant?
Is Office 365 HIPAA compliant? Can healthcare organizations use Office 365 in connection with protected [...]
OCR Issues Second Fine for Noncompliance with HIPAA Right of Access
The Department of Health and Human Services’ Office for Civil Rights has announced another settlement has [...]
How Does DNS Filtering Work?
In this post we answer some commonly asked questions about content filtering, such as what is DNS filtering?, [...]
New Federal Privacy and Data Protection Legislation Introduced
Currently there is no federal privacy and data protection law in the United States, only a patchwork of [...]
German Telecoms Company Gets $10.6 Million Fine for Noncompliance with GDPR
The German data protection authority has imposed one of the largest ever GDPR fines on a telecommunications [...]
Is Google Forms HIPAA Compliant?
Google Forms is a survey administration tool that allows forms to be created for data collection purposes, [...]
Breach Notification Rule Failure Leads to $2.175 Million HIPAA Settlement
A breach notification failure and the lack of a business associate agreement has led to a $2.175 million [...]
20 Common HIPAA Myths Debunked
In this post we cover some of the many HIPAA myths that have been circulating on the internet and often get [...]
German Real Estate Company Issued with €14.5 Million GDPR Fine for Unlawful Data Retention
A German real estate company, Deutsche Wohnen SE, has been issued with a €14.5 million GDPR penalty by the [...]
OCR Makes Inflation Adjustment to HIPAA Civil Monetary Penalties
The Office of the Assistant Secretary for Financial Resources (ASFR), Department of Health and Human [...]
OCR Imposes $1.6 Million Civil Monetary Penalty on Texas Health and Human Services Commission for HIPAA Violations
The Department of Health and Human Services’ Office for Civil Rights (OCR) has fined another HIPAA-covered [...]
Failure to Encrypt ePHI on Portable Devices Results in $3 Million Financial Penalty
The HHS’ Office for Civil Rights (OCR) has announced its sixth HIPAA penalty of 2019. The University of [...]
Updated Security Risk Assessment Tool Released to Help Covered Entities with HIPAA Security Rule Compliance
The Department of Health and Human Services’ Office for Civil Rights (OCR) has released an updated version [...]
Study Suggests Security Enhancements After a Hospital Data Breach Negatively Affects Patient Outcomes
Following a data breach, hospitals implement additional measures to improve their security posture and make [...]
9 Unsecured Medical Databases Found Containing Millions of Patient Records
Security researchers at Wizecase have discovered 9 medical databases containing millions of patient records [...]
Jackson Health System Pays $2.15 Million Penalty for Widespread Noncompliance with HIPAA Rules
Jackson Health System (JHS) has paid a $2.15 million civil monetary penalty to the HHS’ Office for Civil [...]
More Financial Penalties for HIPAA Right of Access Compliance Failures Expected
At the OCR/NIST HIPAA Security Conference in Washington D.C., the Director of the Department of Health and [...]
Dental Practice Gets $10,000 HIPAA Penalty for PHI Disclosures on Social Media
A dental practice has been fined $10,000 by the HHS’ Office for Civil Rights for violating Health Insurance [...]
Poland Issues €645,000 GDPR Penalty for Lack of Organizational and Technical Safeguards
Poland’s Personal Data Protection Office has issued a PLN 2.8 million (€645,000) GDPR penalty to an [...]
HIPAA Right of Access Failure Attracts $85,000 Financial Penalty
The HHS’ Office for Civil Rights has announced the first HIPAA settlement under its HIPAA Right of Access [...]
Senate Stalls on Lifting of Ban on Funding National Patient Identifier System
The Health Insurance Portability and Accountability Act of 1996 called for the Department of Health and Human [...]
400 Million Medical Images Found to Be Freely Accessible Over the Internet
A recent investigation by ProPublica, Greenbone Networks, and the German public broadcaster Bayerischer [...]
Guidance Issued on Securing Picture Archiving and Communications Systems
New guidance has been released by the National Cybersecurity Center of Excellence (NCCoE) on securing picture [...]
Complaint Submitted to Irish DPC over Alleged Google GDPR Workaround
Google is alleged to have been using a ‘GDPR workaround’ to avoid the restrictions on data sharing [...]
Guidance on Securing Corporate-Owned Personally Enabled Devices in Healthcare
and transmit patient information. They ensure healthcare professionals are always contactable and can quickly [...]
HHS Proposes Changes to Ease Restrictions on Part 2 Substance Abuse Disorder Treatment Records
A new rule has been proposed by the Substance Abuse and Mental Health Services Administration (SAMHSA) that [...]
HHS Issues Guidance on Managing Malicious Insider Threats
The Department of Health and Human Services’ Office for Civil Rights has issued guidance for HIPAA-covered [...]
Summary of July 2019 Healthcare Data Breaches
It has been another terrible month for healthcare data breaches – The worst of the year to date in terms of [...]
Third of Healthcare Employees Have Received No Cybersecurity Training
A new Kaspersky Lab study has shed light on why healthcare organizations are so susceptible to data breaches. [...]
Sweden Issues First GDPR Fine to School Over Use of Facial Recognition Technology to Monitor Attendance
Swedish high school has been fined €19,000 for violations of the EU Data Protection Regulation (GDPR) [...]
51% of Healthcare Providers Are Not Fully Compliant with HIPAA Right of Access
Healthcare providers are providing patients with copies of their medical records, but a majority have been [...]
$74 Million Premera Blue Cross Settlement Gets Preliminary Approval
A consolidated class action lawsuit against Premera Blue Cross over its 2014 data breach of 10.6 million [...]
$145 Settlement Proposed by Allscripts to Resolve HIPAA and Anti-Kickback Case
Allscripts Healthcare Solutions has proposed a settlement of $145 million to resolve alleged violations of [...]
National Association of Attorneys General Urges Congress to Align Part 2 with HIPAA
The National Association of Attorneys General (NAAG) has written to Congress demanding changes be made to [...]
AMCA Breach Victim Count Nears $24 Million
Over the past 10 days, several more healthcare providers have announced that they have been affected by the [...]
Premera Blue Cross Settles HIPAA Case for $10 Million
Premera Blue Cross has agreed to settle its HIPAA violation lawsuit and pay a $10 million penalty to resolve [...]
31% of EU Citizens Have Not Heard of GDPR
May 25, 2019 was the first anniversary of the compliance date of the EU’s General Data Protection [...]
British Airways Handed Record £183 Million GDPR Penalty
The UK GDPR supervisory authority has issued the largest ever GDPR financial penalty to date. British Airways [...]
OCR Publishes New HIPAA FAQ for Health Plans on Care Coordination and Continuity of Care PHI Disclosures
New HIPAA guidance for health plans has been published by the Department of Health and Human Services’ [...]
Unauthorized Medical Record Access and Disclosure Results in 1 Year Jail Term
The penalties for HIPAA violations are usually restricted to fines for the covered entity or business [...]
Almost 2 Million Records Exposed in May 2019 Healthcare Data Breaches
It has been another bad month for the U.S. healthcare industry. Rather than April’s record number of [...]
AMCA Files for Bankruptcy Following Massive Data Breach
After 42 years in business, the parent company of American Medical Collections Agency (AMCA) has sought [...]
Businesses Risk GDPR Fines Over Continued Use of Unencrypted USB Devices
Under GDPR, businesses must ensure that any personal data of EU residents that is collected or processed is [...]
More Than 20 Million Individuals Impacted by AMCA Data Breach
The number of individuals affected by the data breach at American Medical Collections Agency (AMCA) continues [...]
PHI of 11.9 Million Quest Diagnostics Patients Compromised in AMCA Data Breach
Quest Diagnostics, one of the largest medical laboratory chains in the United States, has announced that [...]
EHR Provider to Pay $900,000 to Resolve Multi-State HIPAA Case
Just a few days after the HHS’ Office for Civil Rights announced a settlement had been reached with Medical [...]
HHS Confirms When Business Associates Can be Held Directly Liable for HIPAA Violations
The Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009, and the subsequent [...]
Medical Informatics Engineering Issued with $100,000 HIPAA Violation Penalty
The Department of Health and Human Services’ Office for Civil Rights has announced a settlement has been [...]
April 2019 Was the Worst Ever Month for Healthcare Data Breaches
April was a record-breaking month for healthcare data breaches. More data breaches were reported by [...]
Large GDPR Fines for Noncompliance Expected in 2019
It has almost been a full year since compliance with the EU’s General Data Protection Regulation (GDPR) has [...]
High Severity Wormable Windows Vulnerability Patched by Microsoft
The UK’s National Cyber Security Centre has reported a critical vulnerability to Microsoft which could [...]
Multiple HIPAA Violations at Medical Imaging Services Company Result in $3 Million Penalty
Touchstone Medical Imaging, a Franklin, Tennessee-based provider of medical imaging services, has agreed to [...]
OCR Issues New Advice on HIPAA and Software Applications Used by Patients to Access PHI
The Department of Health and Human Services’ Office for Civil Rights (OCR) has issued new advice on HIPAA [...]
HHS Changes Maximum Penalties for HIPAA Violations
The Department of Health and Human Services (HHS) has made changes to the maximum penalties for HIPAA [...]
CMS Starts HIPAA Simplification Rules Audits
The Centers for Medicare and Medicaid Services (CMS) Division of National Standards has recently announced [...]
Study Reveals Widespread Nonconformance with HIPAA Rules and NIST CSF Controls
It has been 14 years since the HIPAA Security Rule requirements have been mandatory, but many healthcare [...]
Deadline Extended for Comments on HHS Health IT and ePHI Interoperability Rules
New rules were published by the Department of Health and Human Services’ Office of the National Coordinator [...]
912,992 Records Exposed in Healthcare Data Breaches in March 2019
February was a particularly bad month for healthcare data breaches, so it is no surprise there was a fall in [...]
GDPR Compliance Has Helped to Reduce Data Breaches in the UK
The UK government has released the results of its annual cybersecurity breach survey which shows a fall in [...]
G2 Crowd Releases Spring 2019 Secure Email Gateway Performance Report
G2 Crowd has released its Spring 2019 G2 Crowd Secure Email Gateway Performance Report. The report highlights [...]
PHI of 12,000 Baystate Health Patients Exposed Due to Phishing Attack
A phishing attack on Baystate Health in Massachusetts has exposed the protected health information (PHI) of [...]
Improving Healthcare Organizations Cybersecurity Through Cross-sector and Bi-partisan Collaboration
On February 21, 2019, Sen. Mark Warner (D-Va) requested feedback from a number of healthcare organizations [...]
1,600 Ohio Patients Impacted by Impermissible Disclosures of PHI
993 Ohio residents who are beneficiaries of Medicaid or have received services from the Ohio Department of [...]
PHI Compromised Due to Emotet Malware Attack on Oregon Endodontic Group and Humana Web Portal Breach
An office computer used by Oregon Endodontic Group has been infected with malware, which may have allowed [...]
New HIPAA-Compliant Alexa Skills Announced
Amazon has announced six new HIPAA compliant Alexa skills have been developed and that the platform can [...]
PHI of 14,305 Patients Exposed Due to a Phishing Attack on Main Line Endoscopy Centers
Main Line Endoscopy Centers, a network of outpatient endoscopy clinics in the Malvern, Media and Bala Cynwyd [...]
Sharp Grossmont Hospital Faces Lawsuit For Video Recording Patients During Gynecology Procedures
Sharp HealthCare and Sharp Grossmont Hospital have been accused of covertly recording videos in an area of [...]
Alert on Advanced Persistent Threats and Zero-Day Exploits Issued by OCR
In its spring cybersecurity newsletter, the HHS’ Office for Civil Rights has warned healthcare [...]
Health Data is the Least Likely Type of Data to Use Encryption
The Ponemon Institute conducted a survey for the Global Encryption Trends Study on behalf of nCipher, a [...]
National Board of Examiners in Optometry to Pay $3.25 Million to Settle 2016 Data Breach Lawsuit
A class action lawsuit that was filed on behalf of victims of a 2016 data breach at the National Board of [...]
Michigan Practice to Close Down Due to Ransomware Attack
A ransomware attack on Brookside ENT and Hearing Center located in Battle Creek prompted the Michigan [...]
Amazon Developed a New System for the De-identification of Medical Images
Amazon recently announced a new system has been launched which can identify the protected health information [...]
Security Breaches Reported by DePaul and Southern Hills Eye Care
DePaul is informing a number of its behavioral health program patients about the exposure of their protected [...]
PHI of 67,493 Burrell Behavioral Health Patients Exposed Due to Business Associate Breach
Burrell Behavioral Health is informing 67,493 patients about the accidental exposure of their healthcare [...]
Class Action Lawsuit Filed Against UnityPoint Health for February 2018 Data Breach
A class action lawsuit has been filed against UnityPoint Health over a data breach that exposed 16,429 [...]
Harvard Business Review Shares Lessons from the Massive Marriott Data Breach
A Harvard Business Review report has been released on the most recent massive data privacy breach involving a [...]
Microsoft CEO Supports Global Enactment of GDPR-Like Legislation
In a recent interview at World Economic Forum in Davos Switzerland, Microsoft CEO Satya Nadella spoke about [...]
Texas Department of Aging and Disability Services To Pay $1.6 Million Settlement Over 2015 Data Breach
The Department of Health and Human Services’ Office for Civil Rights and the Texas Department of Aging and [...]
Healthcare Industry Ranks 8th for Cybersecurity But Must Improve DNS Health and Endpoint Security
By means of complying with HIPAA, healthcare providers have attained a baseline standard of security. [...]
PHI Exposure of Superior Dental Care Patients and L.A. Care Health Plan Members
The dental insurance provider, Superior Dental Care, based in Centerville, Ohio, has discovered an [...]
Concerns Expressed about FDA Medical Device Security Guidance
The U.S. Food and Drug Administration (FDA) is assessing the responses to its draft guidance for medical [...]
Stricter Breach Notification Laws Proposed by D.C. Attorney General
Washington D.C. Attorney General Karl A. Racine wants to reinforce data breach notification regulations to [...]
UCLA Health to Pay $7.5 Million to Settle Class Action Data Breach Lawsuit
UCLA Health has agreed to pay a $7.5 million settlement to resolve a class action lawsuit that was filed on [...]
PHI of 14,894 Patients Impacted by Third Verity Health System Phishing Attack in 3 Months
Verity Health system encountered its third phishing attack in January 2019 in three months, which impacted [...]
Should Dental Offices Worry About HIPAA Compliance?
The first dentist that was issued a fine for a HIPAA violation was Dr. Joseph Beck in 2015. His case served [...]
Vulnerabilities Discovered in Medtronic CareLink Monitors, ICDs and Programmers
Two vulnerabilities have been found in the Conexus telemetry protocol, which is used in Medtronic MyCarelink [...]
Dental Offices May Be Fined for Slow Release of Copies of Dental Records
The Dental Board of California revealed in a recent report that some dentists in the state are not giving [...]
Email Archiving Solution Exposed PHI of 277,319 Patients
ZOLL Medical Corporation, a medical device manufacturer and software developer in Pennsylvania, is informing [...]
When Was HIPAA Enacted?
When did compliance with the Health Insurance Portability and Accountability Act (HIPAA) become mandatory and [...]
Are Google Home and Google Assistant Compliant With HIPAA?
Can medical practitioners use Google Home and Google Assistant? Is Google Assistant HIPAA compliant or would [...]
Is DocuSign HIPAA Compliant?
Can healthcare organizations use DocuSign in association with electronic protected health information (ePHI) [...]
Healthcare Data Breach Report in February 2019
February 2019 saw healthcare data breaches reported at a ate of more than one a day, as was the case in [...]
Is Microsoft Teams HIPAA Compliant?
Microsoft Teams is popular among businesses who use it to improve communication and collaboration, but can it [...]
Is Calendly HIPAA Compliant?
Calendly is a well-known tool that many businesses use for scheduling meetings and appointments. Is it all [...]
Is Evernote HIPAA Compliant?
Evernote is a useful cloud-based tool for taking notes, making to do lists, planning projects, and [...]
Is Google Keep HIPAA Compliant?
Google Keep is a cloud-based note taking application that allows notes to be created and shared across [...]
Sandboxing and DMARC Authentication Integrated into SpamTitan To Detect More Email Threats
Healthcare organizations are increasing investment in cybersecurity solutions to combat the threat from [...]
Healthcare Laptops are a Serious Security Risk
Clearwater CyberIntelligence Institute (CCI) has analyzed security risks in healthcare and found that laptops [...]
Study Confirms Healthcare Employees are Susceptible to Phishing Attacks
Cybercriminals are targeting the healthcare industry and one of the leading ways that access to healthcare [...]
HIPAA Violation Fines
Both the Department of Health and Human Service’ Office for Civil Rights (OCR) and state attorneys general [...]
70,000 People Impacted By Three Healthcare Ransomware Attacks
Three new ransomware attacks have recently been reported by healthcare companies and their business [...]
25% of Healthcare Companies Had a Mobile Security Breach Last Year
The Verizon Mobile Security Index 2019 report shows 25% of healthcare companies have had a security breach [...]
Over 5000 People Impacted by Two Breaches Due to Laptop Theft and Mailing Error
A Massachusetts business associate has reported a breach of the electronic protected health information [...]
Biometric Information Privacy Act Proposed by Florida Lawmakers
New bills (SB 1270 /HB 1153) have been proposed by Senator Gary Farmer (D-FL) and Representative Bobby DuBose [...]
Is Return Path HIPAA Compliant?
Return Path is an email marketing and optimization program that helps companies to put their email marketing [...]
HIPAA Compliance in Conflict with Healthcare Cybersecurity
The College of Healthcare Information Management Executives (CHIME) has told Congress that HIPAA compliance [...]
New HIPAA Regulations in 2019
Though there were HIPAA updates being considered by OCR in 2018, the pace of change is slow and it could well [...]
Is Mandrill HIPAA Compliant?
Does Mandrill support HIPAA compliance? Can healthcare organizations use MailChimp’s transactional email [...]
Dozens of Employees Fired for Snooping on Jussie Smollett’s Medical Records
Dozen of healthcare employees at Northwestern Memorial Hospital in Chicago have been terminated for snooping [...]
7,858 Patients’ PHI Potentially Exposed Due to Covenant Care Email Account Breach
Covenant Care in Aliso Viejo, CA, a network of residential care and skilled nursing facilities, found that an [...]
Is Marketo HIPAA Compliant?
Marketo is an email marketing and lead management platform that has now been acquired by Adobe. Can [...]
New Jersey Assembly Approves Expanded Definition of Personal Information Requiring Breach Notifications
The New Jersey Assembly unanimously approved a bill that broadens the types of personal data that call for [...]
Former Patient Care Coordinator Pleads Guilty to Wrongfully Disclosing PHI with Intent to Cause Harm
Ms. Linda Sue Kalina, 61, of Butler, PA, a former employee of Tri Rivers Musculoskeletal (TRM) and Allegheny [...]
Is SparkPost HIPAA Compliant?
SparkPost is a well-known email delivery and analytics program used by a lot of businesses for communicating [...]
IRS Warns About Tax-Related Phishing Scams
The IRS has launched its 2019 ‘Dirty Dozen’ campaign, which cautions taxpayers about the 12 most commonly [...]
Is JotForm HIPAA Compliant?
JotForm is a software solution that can be used for making online forms. Can healthcare organizations use [...]
Nevada Senator Introduces New Data Privacy Act
Nevada Senator Catherine Cortex Masto, (D-NV) recently proposed a bill called the Data Privacy Act, which [...]
St. Francis Physicians Services Notifies Patients of Milestone Family Medicine Data Breach
Bon Secours St. Francis Health System is informing patients that some of their protected health information [...]
Is Constant Contact HIPAA Compliant?
Constant Contact offers an online and email marketing solution which allow businesses to easily keep in touch [...]
HIPAA-Compliant SFTP Server Requirements
If healthcare providers, health plans, healthcare clearinghouses and business associates of HIPAA-covered [...]
Senator Seeks Answers on Healthcare Cybersecurity from Government Agencies and Healthcare Orgaizations
Senator Mark Warner (D-Va) has written letters to the leaders of the Department of Health and Human Services [...]
Healthcare Associations Request Safe Harbor for Entities That Have Followed Cybersecurity Best Practices
The College of Healthcare Information Management Executives (CHIME), the Association for Executives in [...]
Third-Party Apps’ Health Data Sharing With Facebook Investigated
An analysis of the data collection practices of Facebook by the Wall Street Journal recently revealed [...]
Is MailChimp HIPAA Compliant?
MailChimp is an automated email marketing program used for sending marketing newsletters and emails to [...]
NHS Announces Pagers will be Phased Out by the End of 2021
The Department of Health in the United Kingdom has commissioned a report on the costs of pagers and their use [...]
What is a HIPAA-Covered Entity?
The term “HIPAA covered entity” wasn’t included in the Healthcare Insurance Portability and [...]
Summary of January 2019 Healthcare Data Breaches
After a quiet month in terms of healthcare data breaches, breach reports rose again to more normal levels [...]
New Bill Seeks to Expand the Data Breach Notification Law in California
California already has tough data breach notification laws, but there is a loophole which could soon be [...]
Final Mobile Device Security Guide Released by NIST NCCoE
The National Cybersecurity Center of Excellence (NCCoE) recently published final guidance on mobile device [...]
Kentucky Counseling Center Insider Breach Affects 16,440 Patients
A list of 16,440 Kentucky Counseling Center (KCC) patients was stolen and shared with another person. The [...]
Is Zendesk HIPAA Compliant?
Zendesk is a provider of a customer service software program and support ticketing system. More than 200,000 [...]
Sensitive Health Information Shared in Facebook Closed Groups Allegedly Exposed
A complaint has been submitted to the FTC alleging Facebook as engaged in deceptive practices and has [...]
Cottage Health to Pay $3 Million to Resolve HIPAA Violation Case
The Department of Health and Human Services’ Office for Civil Rights (OCR) has agreed to settle a HIPAA [...]
Almost 1 Million Patients of UW Medicine Have PHI Exposed Online
The accidental removal of protections on a UW Medicine website server resulted in the protected health [...]
New Free Decryptor for GandCrab Ransomware v5.1 Now Available
The Romanian police has developed a new free decryptor for GandCrab ransomware, assisted by [...]
Report Reveals 473% Increase in Healthcare Email Fraud Attacks in 2 Years
Proofpoint revealed in its recent healthcare email security report that there has been a 473% increase in [...]
German Bundeskartellamt Restricts Data Gathering by Facebook
Last week, Bundeskartellamt, the German antitrust authority, determined that Facebook somewhat abuses its [...]
Business Associate Notified Patients of PHI Theft 8 Months After Discovery of a Data Breach
Sharecare Health Data Services (SHDS) provides secure healthcare records management services to healthcare [...]
PHI of 30,000 Memorial Hospital Patients and 5,524 AZ Plastic Surgery Center Patients Breached
Memorial Hospital at Gulfport, Mississippi, is informing around 30,000 patients that unauthorized persons [...]
OIG Audit Findings of National Institutes of Health
The Department of Health and Human Services’ Office of Inspector General (OIG) has released a report of the [...]
42,000 Patients Impacted by 16-Month Malware Attack on Florida Pulmonary & Sleep Medicine Center
The AdventHealth Medical Group Pulmonary & Sleep Medicine in Tavares, Florida, previously called Lake [...]
March 1, 2019 is the Last Day for Submitting Small Healthcare Data Breach Reports
The deadline for submitting 2018 data breach reports for breaches that have affected fewer than 500 [...]
Massive Annual Increase in Exposed Healthcare Records
2018 saw a massive increase in the number of exposed healthcare records according to the 2019 Breach [...]
Theft of Patient Schedules Results in Potential Exposure of PHI of 3,472 Anesthesia Associates of Kansas City Patients
Paperwork containing information on patients has been stolen from an Anesthesia Associates of Kansas City [...]
New Rules on Patient Access and Information Blocking Proposed by ONC and CMS
The HHS’ Office of the National Coordinator for Health Information Technology (ONC) and the Centers for [...]
HIMSS Cybersecurity Survey Reveals Phishing and Legacy Systems Major Security Concerns
HIMSS has published the results of its annual cybersecurity survey. The aim of the survey is to identify [...]
To Whom Should HIPAA Complaints be Reported to Within a Covered Entity?
To whom should HIPAA violation complaints be directed to inside a covered entity? If a healthcare employee [...]
GDPR Supervisory Authorities Have Received 59,000 Data Breach Reports and Issued 91 Fines
DLA Piper’s new report shows there have been 59,430 data breaches reported to EU regulatory authorities [...]
Malware Attack on Pawnee County Memorial Hospital Impacts 7,000 Patients
Pawnee County Memorial Hospital located in Pawnee City, Nebraska, is notifying 7,038 patients that a hacker [...]
GDPR-Style Data Privacy Law Signed into California Legislature
California governor Jerry Brown has signed AB 375 – the California Consumer Privacy Act of 2018 – [...]
Is HIPAA Compliant Email Archiving a Requirement?
Is It Necessary to Archive Emails to Comply with HIPAA? Email archiving is not required by the Security [...]
PHI of 24,000 Georgia Eye Associates Patients Exposed Due to EyeSouth Partners Email Account Breach
A hacker accessed the email account of an employee of EyeSouth Partners and potentially viewed or acquired [...]
HIPAA Compliance for Home Health Care Workers
The issue of HIPAA compliance for home health care workers can be complicated because of specific challenges [...]
What Information Does HIPAA Law Protect?
One of the principal purposes of HIPAA is to ensure the privacy of patients is protected by making sure that [...]
EHR Vendor to Pay $57.25 Million For False Claims Act Violation
Greenway Health LLC, an electronic health record (EHR) software developer based in Tampa, FL, has agreed to [...]
How to Improve Hospital Workflows
Achieving Workflow Optimization in Hospitals The matter of improving hospital workflows is a senior [...]
Wyoming Hospital Records Act of 1991 May be Repealed
Wyoming is contemplating repealing the Hospital Records Act of 1991. The act was created to make sure [...]
24,500 Patients’ PHI Exposed Due to Cyberattacks on Connecticut Eye Clinic and Chaplaincy Health Care
A ransomware attack on Dr. DeLuca Dr. Marciano & Associates, P.C., an eye care clinic located in [...]
IDenticard PremiSys Access Control System Vulnerabilities Identified
ICS-CERT has published an advisory about three vulnerabilities with a high severity rating that are affecting [...]
Data Breaches at Valley Professionals Community Health Center and Sunflower State Health Plan Impact 13,625 Patients
Valley Professionals Community Health Center in Indiana has experienced a phishing attack that has resulted [...]
Aetna Pays $935,000 to California AG to Settle HIV Status Breach Case
The Connecticut health insurer Aetna has agreed to pay a financial penalty of $935,000 to the California [...]
Illinois Biometric Information Privacy Act Allows Legal Action Over Violations Even Without Actual Harm
The Illinois Supreme Court has decided that state residents can file a lawsuit against a private entity when [...]
Hackers Can Exploit Vulnerabilities in Security Cameras
Hackers could exploit vulnerabilities in networked security and surveillance cameras to gain access to the [...]
Guidance for Medical Device Manufacturers Sharing Data with Patients Issued by FDA
The U.S. Food and Drug Administration (FDA) has released guidelines for medical device manufacturers who [...]
Ransomware Attack on FABEN Obstetrics and Gynecology Results in Patient Data Loss
FABEN Obstetrics and Gynecology in Jacksonville, FL has suffered a ransomware attack which has resulted in [...]
HSCC’s New Cybersecurity Framework for Medical Devices
The Healthcare and Public Health Sector Coordinating Council (HSCC) has published a new cybersecurity [...]
2018 Healthcare Data Breaches Analysis
Since October 2009, the Department of Health and Human Services’ office for civil Rights (OCR) has been [...]
PHI of 7,200 Integrity House Patients Stored on Stolen Computers
A break-in at the offices of addiction treatment services provider Integrity House had potentially resulted [...]
Software Updates Issued to Address KRACK Vulnerabilities Affecting Stryker Medical Beds
Cybersecurity vulnerabilities have been identified in Stryker Medical Beds which could potentially be [...]
HITRUST CSF is Now Incorporates GDPR Requirements
HITRUST has incorporated the EU’s General Data Protection Regulation (GDPR) into the HITRUST Cybersecurity [...]
Multiple Vulnerabilities Discovered in LabKey Server Community Edition
Tenable Research security researchers have discovered several flaws in LabKey Server Community Edition [...]
GDPR Compliance To-Do List
The goal of this GDPR To Do List is to assist organizations and businesses that gather, process or retain the [...]
Critical Care, Pulmonary & Sleep Associates Email-Related Breach Impacts 23,300 Patients
A data breach at Critical Care, Pulmonary & Sleep Associates (CCPSA) in Colorado has impacted over 23,300 [...]
Alaska Department of Health and Social Services Breach Impacted 87,000 More Patients Than Previously Thought
In April 2018, the Alaska Department of Health and Social Services (ADHSS) discovered that malware had been [...]
HIPAA Compliance for HR Departments
HIPAA compliance for HR departments is necessary for healthcare and health insurance companies, but even [...]
All-Star Orthopaedics and Dermacare Brickell Data Breaches Impact 77,800 Patients
All-Star Orthopaedics has notified patients of Las Colinas Orthopedic Surgery & Sports Medicine in [...]
Radware Report Talks About Increasing Cost of Cyberattacks
Radware’s new report provides information regarding the threat landscape in 2018 and the dramatic [...]
Healthcare Data Breach Report for December 2018
December was the second-best month of 2018 for healthcare data breaches with only 23 healthcare data breaches [...]
Tougher Data Breach Notification Laws in North Carolina Sought By State AG
With the increasing number of data breaches impacting North Carolina residents in 2017, state representative [...]
US-CERT Issues Alert About Dräger Infinity Delta Patient Monitors Vulnerabilities
The U.S. Department of Homeland Security’s Industrial Control Systems Cyber Emergency Team (US-CERT) [...]
Google Issued a €50 Million GDPR Violation Penalty By CSIL
Google got slapped with a penalty of €50 million Euro ($56.8 million) for a GDPR violation. This is the [...]
Valley Hope Association Alerts Patients About Email-Related Breach
Valley Hope Association has discovered that an unauthorized individual has gained access to an [...]
Revised Common Rule Now In Effect
The Federal Policy for the Protection of Human Subjects (45 CFR part 46), also called the Common Rule, has [...]
CMS Issues New Medicare Cards to Fight Fraud
People with Medicare have now been issued new Medicare cards that have no Social Security numbers printed on [...]
Patient Health Information at Risk Due to Security Failures of the Department of Defense Health Agency
According to a recently issued Department of Defense (DoD) Office of Inspector General report (PDF), the [...]
Doctor Gets Probation for Criminal HIPAA Violation Instead of a Jail Term
A doctor pleaded guilty to committing a criminal violation of HIPAA Rules for wrongfully disclosing the PHI [...]
Email-Related Breach at Lebanon VA Medical Center Exposed the PHI of 1,000 Patients
Lebanon VA Medical Center based in Pennsylvania found out that the protected health information (PHI) of [...]
Does GDPR Apply to Employees?
Is the General Data Protection Regulation (GDPR) also applicable to data of employees, just like with the [...]
Is SharePoint HIPAA Compliant?
SharePoint is a web-based document management and storage system. It is one of the top collaborative [...]
Is WordPress HIPAA Compliant?
WordPress is a well-known content management system used for creating websites. A lot of businesses use [...]
New Data Breach Notification Law in Massachusetts Enacted
A new data breach notification law in Massachusetts was enacted on January 10, 2019. The new law was signed [...]
BenefitMall Email Security Breach: PHI of 111K Individuals Compromised
Centerstone Insurance and Financial Services, doing business as BenefitMall, has sent notifications to over [...]
HIPAA Compliance for Call Centers
HIPAA Compliant Texting in Call Centers HIPAA compliance for call centers is an important concern for all [...]
Marriott Hotels Could Be Penalized Up to $915M for GDPR Breach
The investigation of a General Data Protection Regulation (GDPR) breach by the Marriott Hotels Group revealed [...]
Boston Children’s Hospital DDoS Attacker Sentenced to 10 Years in Jail
Martin Gottesfeld, 34, of Somerville, MA, the hacker responsible for a Distributed Denial of Service (DDoS) [...]
Can Healthcare Professionals Use Personal Phones at Work Without Violating HIPAA?
There is a worrisome practice happening in healthcare centers throughout the country: The utilization of [...]
HIPAA Compliance and Medical Records
Stage 2 Meaningful Use, HIPAA Compliance and EHRs Stage 2 Meaningful Use elevates the standard on the [...]
PHI of Sacred Heart Rehabilitation Center Patients Exposed Due to Phishing Attack
Sacred Heart Rehabilitation Center in Memphis, MI, provides substance abuse treatment and care services for [...]
Multiple Cybersecurity Failures Led to SingHealth’s 1.5-Million Records Breach
A healthcare data breach investigation revealed that failing to implement basic cybersecurity best practices [...]
Phishing Attack on Kent County Community Mental Health Authority Exposed Patient PHI
A targeted phishing attack on Kent County Community Mental Health Authority, dba Network180, began on October [...]
500 Patients of Solis Mammography Informed of Laptop Theft and PHI Exposure
Ben-Ora, Hansen, Vanesian Imaging Ltd, has announced that an unencrypted laptop computer used by a Solis [...]
Feds Launch Awareness Campaign on Private Sector Cyber Risks
The National Counterintelligence and Security Center (NCSC) at the at the Office of the Director of National [...]
Irish Data Protection Commission’s Strict Enforcement of GDPR in 2019
An Irish Data protection Commission (DPC) spokesperson recently disclosed in an interview that DPC is going [...]
Greater GDPR Enforcement Predictions for 2019
Mozilla’s Senior Policy Manager and EU Principal, Raegan MacDonald, issued a statement saying that in [...]
How Employees Can Help Prevent HIPAA Violations
Healthcare institutions and their business associates must be in compliance with the HIPAA Privacy, Security, [...]
Hospitals Incur 64% Higher Advertising Costs After a Healthcare Data Breach
A new study has investigated how advertising expenditures are affected by healthcare data breaches. The [...]
Ransomware Attack on Business Associate of Blue Cross Blue Shield of Michigan
A ransomware attack on a business associate of Blue Cross Blue Shield of Michigan has potentially compromised [...]
Breaches at Podiatric Offices of Bobby Yee and Humana Impact 580,000 People
The Podiatric Offices of Bobby Yee experienced a ransomware attack on October 29, 2018. The attack resulted [...]
Increased Chinese Malicious Cyber Activity Prompts US-CERT to Issue IT Service Provider Warning
The Department of Homeland Security (DHS) United States Computer Emergency Readiness Team (US-CERT) has [...]
Phishing Attack on Orlando Family Physicians Group Impacts 8,400 Patients
Family Physicians Group in Orlando has informed 8,400 patients that a phishing attack has allowed hackers to [...]
2018 HIPAA Fines and Settlements Summary
This post is a summary of the 2018 HIPAA fines and settlements that have been agreed with either the [...]
4,309 Choice Rehabilitation Residents Impacted by Email Account Breach
Choice Rehabilitation of Creve Coeur, MO has announced that an unauthorized person has gained access to an [...]
Copyright © 2007-2020 The HIPAA Guide Site Map Privacy Policy About The HIPAA Guide
