$640,000 Paid by Aetna to Settle HIPAA Violation Case with State Attorneys General
Two mailing errors in 2017 resulted in the impermissible disclosure of Aetna plan members’ protected [...]
Everything you need to know about HIPAA
10 years of HIPAA advice
Articles by HIPAA guide
Biomarin Pharmaceutical and Envision Healthcare Corporation Report Email-Related Breaches
Biomarin Pharmaceutical and Envision Healthcare Corporation have both recently announced that they have [...]
The Duties of a HIPAA Compliance Officer
Under the Healthcare Insurance Portability and Accountability Act, a covered entity or business associate [...]
Changes in HIPAA Regulations and Enforcement in 2018
What changes in HIPAA regulations could be expected in 2018? Are there new HIPAA regulations expected to be [...]
Limited Waiver of HIPAA Penalties in Florida and Georgia in Aftermath of Hurricane Michael
Alex Azar, secretary of the Department of Health and Human Services (HHS) has waived HIPAA sanctions and [...]
PHI of 21,000 Patients of Minnesota DHS Potentially Compromised
Two recent phishing attacks on the Minnesota Department of Human Services (DHS) have resulted in a potential [...]
Vulnerabilities Found in Carestream Vue RIS, PeerVue Web Server and Siemens Healthcare Products
Five advisories have been issued by the Department of Homeland Security’s Industrial Control Systems Cyber [...]
Round Up of Recent Healthcare Data Breaches
Here’s a summary of the healthcare data breaches reported to OCR by healthcare providers and business [...]
HSCC to Issue Cybersecurity Best Practices for Medical Device Manufacturers and Healthcare Organizations
The Healthcare & Public Health Sector Coordinating Council (HSCC) will soon release voluntary [...]
Phishing Attack on Gold Coast Health Plan: PHI of 37,000 Members Potentially Compromised
Gold Coast Health Plan based in Camarillo, CA is alerting 37,000 plan members that hackers have potentially [...]
Is Microsoft Office 365 HIPAA Compliant?
Office 365 is a collection of subscription products from Microsoft that include Word, Excel, PowerPoint, [...]
Why is HIPAA Important?
The Health Insurance Portability and Accountability Act (HIPAA) is an essential set of regulations that were [...]
What Does PHI Stand For?
The acronym PHI is generally used in association with health information, but what does PHI stand for? What [...]
Can A Patient File A Lawsuit for A HIPAA Violation?
Is it possible for a patient to file a lawsuit for a HIPAA violation? There is no private cause of action in [...]
KHOU Employee Found Abandoned Paper Records Containing PHI in Houston Street
An employee of KHOU 11, a CBS-affiliated TV station, discovered abandoned paperwork that contained the [...]
Medical Device Cybersecurity Regional Incident Preparedness and Response Playbook Issued by FDA
On October 1, 2018, the U.S. Food and Drug Administration released a Medical Device Cybersecurity Regional [...]
AggregateIQ Gets the First UK GDPR Notice for Mishandling Personal Data
The Information Commissioner’s Office (ICO) has sent the UK’s first GDPR notice to AggregateIQ, an [...]
Cyber Attack on Facebook Impacts Almost 50 Million Accounts Holders
Facebook’s engineers discovered a serious data breach which was resolved on September 25. The data [...]
Healthcare Industry is More Susceptible to Phishing Attacks Than Other Industries
The healthcare sector is frequently attacked by phishers seeking access to healthcare information located in [...]
NIST’s New Guidance Document on Managing IoT Cybersecurity and Privacy
The National Institute of Standards and Technology (NIST) has released a draft of a guidance document that [...]
Three Legislation Changes on HIPAA Regulations in 2018 Under Consideration by OCR
Because of the policy of two out for every new regulation, it is likely that there will be few new HIPAA [...]
What is a HIPAA Violation?
Everyday, there seems to be a new report about a healthcare provider or health plan that has been discovered [...]
The Compliancy Group Creates Free HIPAA Quiz for HIPAA Compliance Assessment
The Compliancy Group has created a HIPAA Quiz which can be used by healthcare organizations free of charge to [...]
Phishing Attack on Aspire Health Resulted in PHI Theft
Aspire Health is a Nashville, TN in-home services provider for patients diagnosed with critical illnesses. [...]
The Effect of GDPR on Data Breach Reports and Consumer Complaints
With the introduction of the General Data Protection Regulation (GDPR), EU residents now enjoy new rights and [...]
Gynecologist Lost Her License But Did Not Get Jail Time and Fine for Criminal HIPAA Violation
In April 2018, 65-year old former Massachusetts gynecologist Rita Luthra was found guilty of a criminal [...]
Ex-Employee of Brooklyn’s Kings County Hospital Accused of Stealing and Selling Patients’ PHI
An employee of the emergency unit in Brooklyn’s Kings County Hospital has been charged with stealing [...]
Rising Incidences of HIPAA Violations on Social Media
Posting protected health information (PHI) on social media sites, including closed Facebook groups, violates [...]
How is the HITECH Act Related to HIPAA and Electronic Health and Medical Records?
The Health Insurance Portability and Accountability Act (HIPAA) was enacted in August 1996. It was updated in [...]
PHI of 17,000 Independence Blue Cross Members Was Exposed Online
Independence Blue Cross in Philadelphia has notified 17,000 of its plan members that their protected health [...]
California Legislature Approves California Consumer Privacy Act Changes
In June 2018, the California Consumer Privacy Act (CCPA) was approved by the California legislature. The Act [...]
Can Healthcare Vendors Get HIPAA Certification?
Vendors offering their services to healthcare providers that would require access to protected health [...]
FDA to Improve Reviews of Medical Device Cybersecurity
The Department of Health and Human Services’ Office of Inspector General (OIG) has issued a report [...]
CMS Investigates Fairview Southdale Hospital Patient Privacy Violation
The HHS’ Centers for Medicare and Medicaid Services (CMS) has investigated Fairview Southdale Hospital in [...]
Email-Related Breaches Reported by Hopebridge and United Methodist Homes
Hopebridge, a healthcare organization that operates a network of 28 autism treatment centers across the [...]
Texas Nurse Fired for Sharing PHI on Social Media
A nurse employed at Texas Children’s Hospital has lost her job as a result of sharing protected health [...]
What is Regarded as Protected Health Information According to HIPAA?
Some patients, and even some healthcare employees, may not be 100% sure exactly what is regarded as protected [...]
OCR Pubishes Guidance on Patient Data Sharing During a Public Health Emergency
Following President Trump’s declaration of a public health emergency in Virginia due to Hurricane [...]
Acadiana Computer Systems Phishing Attack Impacts 31,000 Individuals
Lafayette, Louisiana-based Acadiana Computer Services Inc., provides software and business solutions to the [...]
New Privacy Framework To Protect the Privacy of Workers and Customers
The National Institute of Standards and Technology (NIST) developed a Cybersecurity Framework in 2014 to [...]
Which Email Providers are HIPAA Compliant?
HIPAA-covered entities need to make certain that protected health information (PHI) sent by email is secure [...]
Healthcare Data Breach Report for August 2018
In August, 28 healthcare data breaches were reported to the HHS’ Office for Civil Rights which represents a [...]
Changes Made to the Apple App Store Privacy Policy Following GDPR Introduction
Starting October 3, 2018, the Apple App Store will implement a new privacy policy rule that will require app [...]
Over 21,000 Patients’ PHI Potentially Exposed Due to Reliable Respiratory Phishing Attack
Reliable Respiratory, a respiratory care provider located in Norwood, MA, has experienced a phishing attack [...]
New Mexico Hospital Health Records Found Scattered in the Street
The New Mexico Department of Health is conducting an investigation into how the confidential medical files of [...]
Requirements of HIPAA Compliant Email
Are Emails HIPAA Compliant? The use of email by HIPAA-covered entities to send sensitive patient health [...]
OCR Reminds Healthcare Organizations to Secure Electronic Media and Devices With ePHI
The Department of Health and Human Services’ Office for Civil Rights has reminded HIPAA-covered entities of [...]
Two-Thirds of UK Companies Do Not Have Insurance for Data Breaches
A recent report from NTT Security has revealed 66% of UK senior executives believe their company is not fully [...]
Two French Location Data Companies Warned Over GDPR Violation
French data regulator CNIL has warned two French data firms, Fidzup and Teemo, to adhere to the EU’s [...]
Nine Vulnerabilities Identified in Philips E-Alert Units
The Department of Homeland Security’s Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) [...]
HIPAA Violation Cases: 2013 – 2017
This page contains a summary of HIPAA violation cases which led to settlements with the Department of Health [...]
Guidance on Securing Wireless Infusion Pumps for Healthcare Delivery Organizations
The final version of the NIST Cybersecurity Practice Guide for Securing Wireless Infusion Pumps in Healthcare [...]
When is a HIPAA Release Form Necessary?
A HIPAA release form signed by the patient ought to be acquired prior to sharing that individual’s [...]
1,790 Patients Impacted by Phishing Attack on Drug and Alcohol Treatment Center in Los Angeles
Authentic Recovery Center, a drug and alcohol treatment center based in West Los Angeles, recently [...]
PHI of 19,570 Missouri Care Members Exposed Due to Mailing Error
An error in a Missouri Care mailing reminding parents to book well-child appointments has resulted in the [...]
22% Less Third-Party Cookies on EU News Sites Post-GDPR
The Reuters Institute at the University of Oxford conducted a study and found that there has been a 22% [...]
BD Announces Critical Vulnerability Found in Alaris Plus Medical Syringe Pumps
Certain BD Alaris Plus medical syringe pumps have been found to contain a critical remotely exploitable [...]
90% of EU Domain Visitors Give GDPR Consent
Consent management platform Quantcast Choice published a recent report that revealed that European Union (EU) [...]
McAlester Hospital Sued Over Impermissible Disclosure of PHI and HIPAA Violation
Dennis and Wayne Russell’s adopted two-year old son Keon died in a tragic swimming pool [...]
How to Make a GDPR Compliant Website
If EU residents can access your website, and your website is used to collect some of their personal [...]
Healthcare Data Breach Report for July 2018
July 2018 is by far the worst month in 2018 with respect to healthcare data breaches. There were 33 [...]
Vulnerabilities Found in Philips IntelliVue Information Center iX and PageWriter Cardiographs
This week, the Industrial Control Systems Cyber Emergency Team (ICS-CERT) has issued two advisories about [...]
70% of Healthcare Companies Do Not Have Cybersecurity Insurance
Ovum conducted a survey recently on behalf of analytics firm FICO, which revealed there has been a major [...]
Survey Reveals Insufficient Anti-Phishing Controls in Place in U.S. Businesses
Phishing is currently the top cyber threat encountered by companies; however, regardless of a high [...]
PHI of 4,000 Patients of Colorado Dermatology Potentially Accessed
Central Colorado Dermatology (CCD) has informed more than 4,000 patients that hackers have potentially [...]
Legacy Health Phishing Attack Exposed 38,000 Patients’ PHI
Legacy Health has discovered an unauthorized individual has accessed its email system and potentially viewed [...]
9,350 Patients of Gordon Schanzlin New Vision Institute Warned About Data Breach
The Gordon Schanzlin New Vision Institute located in La Jolla, CA, has informed thousands of patients that [...]
Anthem’s $115 Million Data Breach Settlement Finally Approved
Anthem Inc. proposed a $115 million settlement in 2017 to resolve the class action lawsuits filed by the [...]
InterAct of Michigan Email Account Compromised Exposing 1,290 Patients’ PHI
The mental health and substance abuse treatment provider InterAct of Michigan has announced that [...]
Adams County Government Data Breach Impacts 258,000 People
A data security breach has occurred in Adams County, Wisconsin where the personal identification information, [...]
Augusta University Health Phishing Attacks Affected 417,000 People
Augusta University Health has announced it has experienced a data breach that has affected approximately [...]
Vulnerabilities in Philips IntelliSpace Cardiovascular Products Discovered
ICS-CERT has issued a warning regarding two vulnerabilities that have been discovered in Philips IntelliSpace [...]
Serious Vulnerabilities Discovered in Maryland’s Medicaid Management Information System
The Department of Health and Human Services’ Office of Inspector General (OIG) has released the results of [...]
Microsoft ADFS Vulnerability Allows Threat Actors to Bypass Multi-Factor Authentication
A vulnerability (CVE-2018-8340) has been identified in Microsoft’s Active Directory Federation Services [...]
Flaws in Patient Monitors Could Allow Hackers to Alter Vital Signs Data
Douglas McKee, a security researcher at McAfee, discovered a flaw in the communications protocol used to send [...]
Vulnerabilities in Fax Machines May Allow Network Access and Exfiltration of Sensitive Data
Healthcare companies still extensively use faxes for communication and in some hospitals, as much as 75% of [...]
Did the Oklahoma Department of Veteran Affairs Violate HIPAA Rules?
Three Democrat lawmakers have accused the Oklahoma Department of Veteran Affairs of violating Health [...]
New Phishing Websites Detections Rose By 46 Percent in Q1, 2018
The Anti-Phishing Working Group has published its Q1, 2018 Phishing Activity Trends Report. The report [...]
13,034 Patients Affected by MedSpring Urgent Care Breach
MedSpring Urgent Care, a network of emergency care clinics located in Austin, Atlanta, Chicago, Houston, Fort [...]
Further Vulnerabilities Identified in Medtronic MyCareLink Patient Monitors
An advisory has been issued by ICS-CERT regarding vulnerabilities found in MiniMed 508 Insulin Pumps and [...]
SamSam Ransomware Attack on Atlanta Likely to Cost $17 Million to Resolve
The SamSam ransomware attack on Atlanta City was expected to cost around $6 million to resolve; however a [...]
More Than 3.14 Million Healthcare Records Were Exposed in Q2, 2018
Protenus has released its Q2 2018 Breach Barometer Report – A summary and analysis of healthcare data [...]
Over 20 Serious Vulnerabilities Found in OpenEMR Platform
OpenEMR is a free, open-source electronic health record (EHR) management system that is used by a large [...]
PHI of 300,000 SSM Health Patients Exposed
Approximately 300,000 patients of SSM Health St. Mary’s Hospital in Jefferson City, Missouri have been [...]
OCR Reminds Healthcare Companies the Proper Disposal of Electronic Devices and Media
The Department of Health and Human Services’ Office for Civil Rights, in the July edition of its [...]
Hacktivist Convicted for DDoS Attack Facing 15 Years in Jail
The hacktivist, Martin Gottesfeld, 32, who was responsible for the Distributed Denial of Service (DDoS) [...]
Email Account Compromises Leading Cause of Q2 2018 Data Breaches
In the past year, email account compromises have been steadily increasing according to the July edition of [...]
New Guide for Securing Electronic Health Records on Mobile Devices Released by NIST/NCCoE
Physical, technical, and administrative controls can be implemented to secure ePHI on servers and desktop [...]
Four Healthcare Data Breaches Exposed the PHI of 9,400 Patients
This is a summary of data breaches that have recently to the Department of Health and Human Services’ [...]
Appointing a GDPR Lead Supervisory Authority
The GDPR defines a Supervisory Authority as an independent public authority responsible for checking [...]
UnityPoint Health Phishing Attack Affects 1.4 Million Patients
A phishing attack on UnityPoint Health has allowed hackers to gain access to the protected health information [...]
Consumers are Less Concerned About Breaches of Health Data Than Financial Data
The healthcare marketing agency SCOUT recently conducted a survey that revealed consumers are less concerned [...]
19,000 Patients of Orlando Orthopaedic Center Affected by Transcription Service Provider Breach
The protected health information (PHI) of over 19,000 patients was exposed due to an error by a transcription [...]
HHS to Release Information for the Proposed Changes on Federal Health Privacy Rules
Alex Azar, Secretary of the Department of Health and Human Services (HHS), explained in an address at The [...]
Confluence Health Discovers Phishing Attack Resulted in PHI Exposure
A data breach has been reported by Confluence Health, a non-profit health system managing Wenatchee Valley [...]
17,000 Patients’ PHI Exposed in Oregon and Massachusetts
The medical records of more than 17,000 patients have been exposed in two data breaches in Oregon and [...]
Requirements for GDPR Data Breach Reporting
Healthcare companies need to issue notifications when the personal information of GDPR data subjects is [...]
US-CERT Warns About Increasing ERP System Attacks
The United States Computer Emergency Readiness Team (US-CERT) has warned companies abut the growing risk of [...]
$150,000 Settlement Proposed by Flowers Hospital for 2014 Data Breach
A class action lawsuit filed in the aftermath of a data breach at Flowers Hospital in Dothan, Alabama in 2014 [...]
More than 105,000 Individuals Affected by Healthcare Phishing Attack
Boys Town National Research Hospital (Boys Town) in Omaha, NE has discovered that an employee was fooled by a [...]
New Massachusetts Bill Proposes 18 Months Complimentary Credit Monitoring Services for Data Breach Victims
A new bill has been proposed in the state of Massachusetts that aims to enhance protections for customers [...]
Malware and Ransomware Attack on Blue Springs Family Care Affects Almost 45,000 Patients
Blue Springs Family Care in Missouri was attacked with ransomware resulting in the encryption of [...]
New Guidance on Using EHR Data in Clinical Research Issued By the U.S. FDA
The U.S. Food and Drug Administration (FDA) has introduced new guidance about the usage of EHR data in [...]
3,775 Patients Informed of Unauthorized Access to a New York Physician’s Computer
Ruben U. Carvajal, MD, a doctor in New York, has started informing his patients that unauthorized individuals [...]
M.M. Ewing Continuing Care Center Employees Fired Over Snapchat Photo Sharing
Thompson Health’s M.M. Ewing Continuing Care Center, a nursing home in Canandaigua, NY, has discovered that [...]
Healthcare Data Breach Report for June 2018
Reported healthcare data breaches in June 2018 increased by 13.8% month-over-month although there were 42.48% [...]
44,600 Patients Affected by Golden Heart Administrative Professionals Ransomware Attack
Golden Heart Administrative Professionals based in Fairbanks, AK is a billing company that serves as a [...]
Phishing Attacks on Sunspire Health and UPMC Cole Compromised Several Employee Email Accounts
Two more healthcare companies have announced they have been victims of phishing attacks that have allowed [...]
LabCorp Attacked with Ransomware But PHI Access Still Not Confirmed
LabCorp, a major network of clinical laboratories in the U.S., experienced a cyberattack that potentially [...]
Role of the Data Protection Officer Under GDPR
Any company that collects and/or processes the personal data of EU residents needs to comply with the General [...]
Phishing Attack on Alive Hospice Compromised Patients’ PHI
Alive Hospice in Tennessee has discovered the email accounts of two employees were compromised after the [...]
UMC Physicians and MSK Group Notify Patients of PHI Breach
The email account of a doctor at UMC Physicians in Texas was hacked, which resulted to the potential exposure [...]
Billings Clinic Employee’s Email Account Hacked Exposing 8,400 Patients’ PHI
The protected health information (PHI) of 8,400 patients contained in the email account of an employee of [...]
PHI of HIV Patients Exposed Because Metro Health Employee Made a Mistake
According to a report published in The Tennessean, a Metro Health employee made an error that resulted in the [...]
Factors that Increase the Cost of Resolving a Data Breach
The Ponemon Institute and IBM have explained several factors that impact the cost of data breaches in the [...]
Healthcare Data Breach Costs Now $408 Per Record
The Ponemon Institute has conducted its annual Cost of a Data Breach Study on behalf of IBM Security, which [...]
Lack of Authentication Controls on MedEvolve FTP Server Exposed Patients’ PHI
An FTP server used by MedEvolve, a provider of billing and medical record services to healthcare providers, [...]
Lawsuit Filed Against Children’s Mercy Hospital for Data Breach of 63,000 Patients’ PHI
A lawsuit has been filed against Children’s Mercy Hospital following a phishing attack that resulted in the [...]
Patient Privacy and Security Are Most Important to Consumers According to Aetna Survey
Health insurer Aetna conducted a survey about consumers’ attitudes toward healthcare, their associations [...]
Does the GDPR Apply to Medical Devices?
The EU General Data Protection Regulation (GDPR) has been in effect since May 25, 2018. All companies that [...]
Arkansas Children’s Hospital Employee Terminated For PHI Theft Involvement
Law enforcement is investigating a former employee of Arkansas Children’s Hospital for being involved in [...]
EHR Vendor’s Coding Error Caused the Impermissible Sharing of Patient Health Data
The UK’s National Health Service (NHS) has informed 150,000 patients that their health data was shared for [...]
Main Line Health Wins Age Discrimination Case Filed By Terminated Employee
In 2016, Main Line Health Inc. based in Radnor, PA dismissed an employee named Gloria Terrell for a violation [...]
Ransomware Attack on Cass Regional Medical Center Shuts Down EHR System
Cass Regional Medical Center in Harrisonville, MO has announced it suffered a ransomware attack at 11 am on [...]
API Vulnerabilities and USB-Related Cyberattacks Identified
HIMSS has published its June Healthcare and Cross-Sector Cybersecurity Report, in which warnings have been [...]
Manitowoc County Phishing Attack Resulted in PHI Theft
Manitowoc County in Wisconsin fell victim to a phishing attack resulting in the theft of protected health [...]
OCR Explains the Importance of Patch Management for HIPAA Compliance
OCR has reminded healthcare organizations of the importance of patch management for HIPAA compliance. Patches [...]
AHA Provides Extensive Feedback on CMS’ Hospital Inpatient Prospective Payment System Proposed Rule
The American Hospital Association (AHA) has submitted extensive comments about the HHS’ Centers for [...]
Humana Notifies Members About Sophisticated Cyber Spoofing Attack That Exposed PHI
Humana is informing members about a “sophisticated spoofing attack” which potentially resulted in [...]
Healthcare Employee Indicted for Criminal HIPAA Violations
A former patient information coordinator at the University of Pittsburgh Medical Center has been indicted by [...]
New Data Privacy Law Signed by California Governor Offering GDPR-Style Protections
The California Consumer Privacy Act of 2018, AB 375, has been signed into law. California governor Jerry [...]
Potential Theft of PHI from Alaska DHSS Due to Zeus Trojan Infection
The Alaska Department of Health and Social Services (ADHSS) is informing ‘over 500’ persons that hackers [...]
GDPR Right to Access Personal Data
Healthcare companies marketing or offering their services to EU residents that involves the collection or [...]
2017 FBI Internet Crime Report Shows Harm Caused by BEC Attacks
The FBI 2017 Internet Crime Report has been released. The report is based on the complaints received by the [...]
PHI of 870 Patients of Michigan Medicine Potentially Exposed Due to Laptop Theft
Michigan Medicine has informed 870 of its patients that an unencrypted laptop computer has been stolen, [...]
Qcentive Uses ParkMyCloud to Save on AWS Costs & Cloud Computing in Healthcare
Healthcare startup Qcentive is the creator of a cloud-based platform that allows healthcare organizations to [...]
PHI Breach at Associated Dermatology & Skin Cancer Clinic of Helena Impacts 1,254 Patients
A breach of physical protected health information (PHI) has been reported by Associated Dermatology & [...]
Grant Medical Center Repeatedly Sent Faxes with PHI to the Wrong Recipient
OhioHealth’s Grant Medical Center sent faxes containing the protected health information (PHI) of a [...]
Common Rule Compliance Date Now January, 19 2019
The federal government published on June 19, 2018 the final rule for the Federal Policy for the Protection of [...]
PHI Breach Due to Interception of Unencrypted Hospital Pages
Outdated pager systems have now been replaced by secure messaging systems in many healthcare organizations. [...]
There’s No Private Cause of Action in HIPAA According to District Court Ruling
Patients who think that there has been a violation of HIPAA Rules can send a complaint to the Department of [...]
Is Rackspace HIPAA Compliant?
Rackspace is a cloud computing company based in Windcrest, Texas that provides public cloud and email hosting [...]
Vulnerabilities Identified in Natus Xltek NeuroWorks Software
ICS-CERT has released an advisory following the discovery of eight vulnerabilities in version 8 of Natus [...]
Washington Health System Employees Suspended for Unauthorized PHI Access
Washington Health System has suspended a number of its employees after discovering they inappropriately [...]
GDPR Rules for Recording Calls
Any company anywhere in the world that records calls from EU residents needs to follow the GDPR rules for [...]
Phishing Attack on FAPD and Black River Medical Center
Two HIPAA-covered organizations have recently announced they have been victims of phishing attacks that [...]
Healthcare Data Breach Report for May 2018
In April 2018, 41 healthcare data breaches were reported to the HHS’ Office for Civil Rights. The 29 [...]
Med Associates Breach Potentially Affected 270,000 Patients
Med Associates in Latham, NY is a health billing company that provides claims services to over 70 healthcare [...]
University of Texas MD Anderson Cancer Center Ordered to Pay $4.3 Million HIPAA Violation Penalty
The Department of Health and Human Services’ Office for Civil Rights recently issued its fourth largest [...]
Employee Guilty of PHI Theft Jailed: Snooping Employees Fired
An ex-employee of Veteran Affairs Medical Center in Long Beach, CA named Albert Torres, 51, was sentenced to [...]
Cofense Triage is One of the Top Security Software Solutions of 2018
CSO Online’s 2018 list of the best security software solutions for 2018 included Cofense Triage: The [...]
Understanding the Requirements on Issuing Individual Authorization for Uses and Disclosures of PHI for Research
To help HIPAA-covered entities to streamline HIPAA authorizations for the use of protected health information [...]
Vulnerabilities in Siemens RAPIDLab and RAPIDPoint Blood Gas Analyzers Announced by Siemens
Siemens published a bulletin about two recently identified vulnerabilities in RAPIDLab and RAPIDPoint Blood [...]
Burglaries in Corpus Christi and San Francisco Resulted in PHI Breach
Patients of two HIPAA-covered entities received notification that their protected health information (PHI) [...]
33% of Healthcare Organizations Expected to Miss the GDPR Deadline
Healthcare providers that provide services to patients from the European Union, or market their services to [...]
Is SendGrid HIPAA Compliant?
SendGrid is a platform that companies use for email marketing. It makes communicating marketing messages to [...]
Healthcare Providers Lack Funds to Improve Medical Device Security According to Survey
HIMSS recently conducted a survey that confirmed that medical device security is a major priority at most [...]
TitanHQ and Datto Partnership Strengthens Web Security Solutions for MSPs
TitanHQ, the leading email and web security solution provider, has entered into a strategic partnership with [...]
Phishing Attack on HealthEquity Potentially Compromised Members’ PHI
HealthEquity Inc based in Draper, UT, suffered a phishing attack which resulted in the protected health [...]
Hospitals and Physicians Confirm Mobile Technology Helps Improve Patient Outcomes
Black Book Research has published the results of a survey on the use of mobile technology by hospitals and [...]
Phishing Attack on Terros Health Potentially Exposed 1,600 Patients’ PHI
An employee working for Terros Health in Phoenix, AZ fell for a phishing scam and inadvertently disclosed [...]
Ransomware Attack on Rise Wisconsin Potentially Impacted 3,700 Plan Members
Rise Wisconsin is notifying over 3,700 plan members of an incident that has potentially resulted in an [...]
What Rights Do Data Subjects Have Under GDPR?
The General Data Protection Regulation (GDPR) came into force in the EU on May 25, 2018. Its purpose is to [...]
Nurse Faces 12-Months Suspension for Disclosing Patient Information to New Employer
A nurse practitioner has had her license to practice suspended for 12 months by the New York State Education [...]
Server and Email Hacking Potentially Compromised PHI of Patients
Hacking incidents continue to dominate healthcare data breach reports. One such incident has recently been [...]
Impostor and Burglar Obtained the PHI of Patients
Blue Cross Blue Shield of Illinois has discovered the the protected health information (PHI) of a number of [...]
Healthcare Employees Stole Patients’ PHI to Take to New Employers
Former employees of two HIPAA-covered entities accessed and stole patients’ protected health information [...]
Potential Legal Action Over EMS Worker Due to Facebook Post
Kathy Raymond from Roane County, TN, is considering taking legal action against an EMS worker over a Facebook [...]
Two Lawsuits Filed Over Alleged HIPAA Violations
Two lawsuits have recently been filed over violations of HIPAA Rules. One case involved a former employee of [...]
New Data Protection Law Signed in Colorado
A new bill – HB 1128 – has been signed into law by Colorado Governor John Hickenlooper which [...]
New Apple Health Records API Allows Developers to Create Apps for Patients and Access EHR Data
Apple has launched an application programming interface (API) that developers can use to create health apps [...]
Vulnerabilities Found in Philips IntelliVue Patient and Avalon Fetal Monitors
An advisory was issued by the Department of Homeland Security’s Industrial Control Systems Cyber [...]
Are Law Firms Violating HIPAA When Using Geofencing Technology to Target Patients in ER Rooms?
Geofencing is a technology that creates a digital fence around a particular location or space online allowing [...]
Aetna Attempts to Recover Privacy Breach Settlement Costs By Filing Further Lawsuit
Another lawsuit has been filed by Aetna in an attempt to recover the costs incurred due to a 2017 privacy [...]
Purdue University Discovered Two Security Breaches Potentially Compromising PHI
Purdue University’s security team discovered two security breaches in April that potentially allowed [...]
Dignity Health Reported to OCR Multiple Data Breaches
Dignity Health reported multiple data breaches and HIPAA violations to the Department of Health and Human [...]
Covered Entities Are Reminded Not to Neglect Physical Security Controls
The Department of Health and Human Services’ Office for Civil Rights (OCR) is reminding HIPAA covered [...]
Why Choosing Secure Messaging Platforms Over Pagers is Important for HIPAA Compliance
Is it the End of Paging? Since changes have been made to the HIPAA Privacy and Security Rules, there has been [...]
Update on BeaconMedaes TotalAlert Scroll Medical Air Systems Web Application Vulnerabilities
The Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) has issued a bulletin warning [...]
Aultman Health Foundation Phishing Attack Potentially Impacts 42,600 Patients
Aultman Health Foundation is informing around 42,600 patients that their protected health information (PHI) [...]
Is Emailing Patient Names Considered as a HIPAA Violation?
Email is a valuable and convenient means of communication. Can healthcare companies employ email to deliver [...]
Difficulty Solving Healthcare Data Breaches Due to Lack of Visibility into Employee Activity
According to Dtex Systems’ 2018 Insider Threat Intelligence Report, security teams are not able to [...]
What is GDPR Special Category Data?
As per the GDPR, companies are obliged to protect the personal data of data subjects; however, GDPR special [...]
How to make HIPAA Complaints within a Covered Entity
Who should be informed within the covered entity when you want to make a HIPAA complaint? Any healthcare [...]
Many Healthcare Organizations Use DMARC But Fail to Implement It Effectively
Healthcare organizations can use DMARC, the Domain-based Message Authentication, Reporting and Conformance [...]
MGMA Urges CMS to Enforce Compliance with HIPAA Administrative Simplifications
The Department of Health and Human Services’ Office for Civil Rights has issued many financial penalties [...]
Is Amazon Web Services HIPAA Compliant?
Amazon Web Services possesses all the security requirements to meet the HIPAA Security Rule and Amazon is [...]
What Does the GDPR Right to Object Mean?
There is a provision in the General Data Protection Regulation (GDPR) that allows data subjects to object to [...]
Minnesota Ransomware Attack Potentially Impacted 6,500 Patients
The Associates in Psychiatry and Psychology (APP) based in Rochester, MN had a ransomware attack which [...]
NIST Cybersecurity Framework Certification Now Available at HITRUST
HITRUST, the security and privacy standards development and accreditation organization, is now providing [...]
What is the HIPAA Conduit Exception Rule?
A lot of HIPAA covered entities are not aware of the HIPAA Conduit Exception Rule. Consequently, there are [...]
HHS OCR Plans to Give HIPAA Breach Victims Percentage of Breach Settlements
In the 2009 Health Information Technology for Economic and Clinical Health (HITECH) Act, there’s a [...]
LifeBridge Health Data Breach Impacts 538,000 Patients
LifeBridge Health in Baltimore experienced a data breach which was mentioned in a press release on May 16, [...]
Is Google Hangouts HIPAA Compliant?
Healthcare providers often question whether Google services are HIPAA compliant, including whether Google [...]
Is Azure HIPAA Compliant?
Healthcare companies are not forbidden by HIPAA to utilize cloud services. With cloud services, organizations [...]
Taking on the Challenge to Resolve Cybersecurity Vulnerabilities
Healthcare companies quickly fall victim to cyberattacks as a result of continually utilizing out-of-date [...]
Transcription Company Web Portal Breach Exposed Patients’ Medical Notes
MEDantex, a transcription company, inadvertently left patient healthcare information unsecured and openly [...]
Malware Attack on Florida Hospital Websites Potentially Exposed Patients’ PHI
Florida Hospital utilizes three websites that were attacked by malware. Due to the malware attack, it is very [...]
Jury to Decide If Psychiatrist’s Dismissal was Indeed Due to HIPAA Violation
Steward Healthcare System in Boston fired Dr. Alexander Lipin, a psychiatrist, for allegedly violating HIPAA [...]
Is HelloFax HIPAA Compliant?
Can healthcare organizations use HelloFax to send documents containing protected health information (PHI)? [...]
Indiana Physicians Group Attacked with SamSam Ransomware
Part of Allied Physicians Group of Michiana’s network was down because of a ransomware attack. This [...]
New Cybersecurity Law Covering the Insurance Industry Signed in South Carolina
South Carolina Governor Henry McMaster signed into law the South Carolina Insurance Data Security Act on May [...]
Lincare Agreed to Pay $875,000 to Settle W-2 Phishing Scam Lawsuit
Lincare Inc, a respiratory therapy supplier company, agreed to pay $875,000 as settlement for a class-action [...]
Problems Faced by Providers in Processing Copies of Patient Health Records
In a recent Government Accountability Office (GAO) audit as required by the 21st Century Cures Act, the [...]
Nine Security No-Nos for Healthcare Employees
Healthcare companies and their business associates need to adhere to the HIPAA Privacy, Security, and Breach [...]
Is WebEx HIPAA Compliant?
WebEx is a platform for online video conferencing and collaboration helping organizations interact with [...]
GAO Reports Patients Still Pay Excessive Fees for Copies of Their Medical Records
The Government Accountability Office (GAO) recently conducted an audit which showed that patients still face [...]
Healthcare Data Breach Report for April 2018
April was a bad month for the healthcare industry because of the higher number of data breaches and the [...]
Is FaceTime HIPAA Compliant?
Can HIPAA covered entities use FaceTime for communicating protected health information (PHI) without breaking [...]
Is Facebook Messenger HIPAA Compliant?
Is Facebook Messenger HIPAA compliant? Could it be used by healthcare organizations as the messaging service [...]
Nuance Communications Data Breach Potentially Impacts 45,000 Patients
Nuance Communications based in Burlington, MA filed with the U.S. Securities and Exchange Commission about [...]
What is a GDPR Data Retention Policy?
Organizations that collect or process the personal data of people residing in the EU need to update their [...]
Is Microsoft Outlook HIPAA Compliant?
Software programs or email services cannot be completely HIPAA compliant, because technology is not just the [...]
Can Amazon Alexa Be Used in Healthcare?
The use of Amazon Alexa is limited in healthcare because it is not HIPAA compliant. But that may change [...]
Why Healthcare Organizations Suffer More Cyberattacks than Other Industries
Black Book Research conducted a survey where over 2,400 security professionals from 680 healthcare [...]
2,553 Eye Care Surgery Center Patients’ PHI Potentially Exposed
Eye Care Surgery Center, Inc, which is located in Baton Rouge, LA, discovered on February 26, 2018 that one [...]
HIPAA Regulations for SMS
Almost all SMS messaging platforms aren’t HIPAA Compliant. There is no HIPAA rule that particularly [...]
90,000 Health Records Exposed Due to Phishing Attacks on Healthcare Organizations
The number of successful phishing attacks on healthcare organizations has increased in the past few weeks. In [...]
Vulnerabilities Found in Phillips, Silex and GE Medical Devices
The Department of Homeland Security’s (DHS) Industrial Control Systems Cyber Emergency Response Team [...]
DoDIG Audit Report on Navy and Air Force EHR and Security Systems
The Defense Health Agency (DHA), the Navy and the Air Force recently had their second Department of Defense [...]
De-identification of Protected Health Information
Healthcare companies and business associates that would like to access or share protected health information [...]
Are EU Citizens Residing in the US Protected by GDPR?
The General Data Protection Regulation (GDPR) generally applies to European Union citizens living in the EU. [...]
Cerebral Palsy Research Foundation of Kansas Breach Exposed 8,300 Patients’ PHI
Cerebral Palsy Research Foundation of Kansas (CPRF) discovered on March 10, 2018 that the security protection [...]
How Tristar Medical Group Reduced its Cloud Costs by 60%
There are many advantages to using the cloud. More and more healthcare organizations are using it for their [...]
Patients Filed Class Action Lawsuit on UnityPoint Health Over Misleading Data Breach Notification
UnityPoint Health discovered a data breach on February 15, 2018 that resulted to the exposure of the [...]
17,639 Capital Digestive Care Patients’ PHI Exposed
Capital Digestive Care, an MD-based gastroenterology group in Silver Spring, discovered the error that its [...]
Summary of the HIPAA Breach Notification Rule
The Health Insurance Portability and Accountability Act of 1996 is an important legislation to the healthcare [...]
Protenus Q1 2018 Report Highlights the Problem of Insider Breaches in Healthcare
The Protenus’ quarterly breach barometer report is a compilation of data breach information provided by [...]
3 Employees of University of Arkansas Medical Sciences Fired for Patient Privacy Violation
The University of Arkansas Medical Sciences (UAMS) fired three employees because of an alleged violation of [...]
The Cost of GDPR Compliance
The day when the General Data Protection Regulation will be implemented is very near – May 25, 2018. [...]
Massachusetts Doctor Found Guilty of Criminal HIPAA Violation
It’s not very common for HIPAA violations to get criminal penalties, but there are cases when the [...]
Is WhatsApp HIPAA Compliant?
When WhatsApp declared it was launching end-to-end encryption, healthcare organizations became interested [...]
The Impact of Increasing SamSam Ransomware Attacks
Ten SamSam ransomware attacks occurred since December 2017. Most of the attacks were on government and [...]
PHI of 85,000 Patients of Center for Orthopedic Specialists Impacted by Ransomware Attack
Patients consulting with the Center for Orthopaedic Specialists received warning that some of their protected [...]
Is Slack HIPAA Compliant?
Slack is an effective tool for communication and collaboration, however, there is a question on using Slack [...]
What is High Risk Data Processing Under the GDPR?
Another question that has come up with the impending implementation of the General Data Protection Regulation [...]
BD Leads Medical Industry with Proactive Resolution of KRACK Vulnerability
The Department of Homeland Security (DHS) warned about a vulnerability that is affecting a lot of medical [...]
What is the Purpose of HIPAA?
The Health Insurance Portability and Accountability Act – or HIPAA is a vital legislation which affects [...]
How to Report a HIPAA violation
It is the duty of HIPAA covered entities to make sure that their personnel know the right steps for reporting [...]
What Should A Patient Do If There is an Obvious HIPAA Violation?
A patient is unable to sue a healthcare organization for a HIPAA violation and demand damages even though the [...]
Importance of the HIPAA
The Health Insurance Portability and Accountability Act (HIPAA) is a legislation introduced in 1996, mainly [...]
Healthcare Industry Attacked by New Orangeworm Threat Group
As reported by Symantec, there is a recently discovered threat group labeled as Orangeworm, which is [...]
OCR Recommends Risk Analysis And Gap Analysis
OCR published in its April 2018 cybersecurity newsletter the importance of performing a gap analysis. While a [...]
PHI of 100 Patients In the Possession of a Terminated Employee
An employee of Texas Health and Human Services Commission (HHSC) has the protected health information (PHI) [...]
Scenic Bluffs Community Health Centers Notified 2,889 Patients of PHI Breach
Scenic Bluffs Community Health Centers discovered on March 1, 2018 an email account breach, which resulted to [...]
HIPAA’s Records Retention Requirements
A lot of covered entities do not fully understand the requirements of HIPAA medical records retention and [...]
Mailing Printing Error Resulted to the Exposure of 3,000 Patients’ PHI
Maximus Inc is a business process management and technology solutions company providing their services to [...]
What is GDPR’s Definition of Personal Data?
The General Data Protection Regulation (GDPR) is a new legislation that will dictate how personal data [...]
Is Google Voice HIPAA Compliant?
Can healthcare providers and its employees utilize Google Voice? Is this telephony service HIPAA compliant? [...]
GDPR and Employee Personal Data
There are still many questions that people ask regarding the General Data Protection Regulation (GDPR), which [...]
Copyright © 2007-2018 The HIPAA Guide Site Map Privacy Policy About The HIPAA Guide