Over 1.3 Million Individuals Affected by Cyberattack and Data Theft Incident at Broward Health
On January 1, 2021, Broward Health announced it was the victim of a cyberattack involving data exfiltration [...]
Articles by HIPAA guide
New Jersey Companies Settle State HIPAA Investigation and Pay $425,000 Penalty
The New Jersey attorney general has been the most active enforcer of compliance with the Health Insurance [...]
Dutch DPA Fines Tax and Customs Administration €2.75 Million for GDPR Violations
The Dutch Data Protection Authority, Autoriteit Persoonsgegevens (AP), has announced it has imposed a [...]
Half a Million Records Potentially Stolen in 2 Healthcare Ransomware Attacks
The healthcare industry in the United States continues to be targeted by ransomware gangs. Recently, the [...]
HHS Launches Cybersecurity Web Resource for the Healthcare and Public Health Sector
The Department of Health and Human Services is facing an unprecedented number of cyber threats and more data [...]
5 Healthcare Providers Slapped with Financial Penalties for HIPAA Right of Access Violations
The Department of Health and Human Services’ Office for Civil Rights (OCR) launched an enforcement [...]
States Introduce Laws Covering the Collection, Use, and Sharing of Genetic Data
Most healthcare organizations in the United States are required to comply with the Health Insurance [...]
HC3: Cobalt Strike Penetration Testing Tool Increasingly Abused in Attacks on the Healthcare and Public Health Sector
Cybercriminals and Advanced Persistent Threat (APT) actors are increasingly using Cobalt Strike in attacks on [...]
New Jersey Agrees $130,000 HIPAA Settlement with Two Printing Companies
Two printing/mailing vendors have agreed to settle an investigation by the state of New Jersey that alleged [...]
EHR Vendor Reports Breach of PHI of Nearly 320,000 Patients
The protected health information of almost 320,000 patients has potentially been compromised in an August [...]
Second GDPR Investigation of Dutch Tax and Customs Administration Uncovers GDPR Violations
The Dutch Tax and Customs Administration has violated the core principles of the EU General Data Protection [...]
Study Reveals Healthcare Organizations Are Overexposing Sensitive Data
Limiting access to protected health information (PHI) is one of the fundamental requirements of the Health [...]
Maximum 7-Year Sentence for University of Pittsburg Medical Center Hacker
A Michigan man who hacked into the human resources databases of University of Pittsburg Medical Center (UPMC) [...]
$495,000 HIPAA Settlement Reached Between New Jersey and Fertility Clinic
An investigation by the state of New Jersey into a cyberattack on a fertility clinic has uncovered multiple [...]
Irish Data Protection Commission Proposes €28-36 Million GDPR Fine for Facebook
A financial penalty for GDPR violations totalling €28-€36 million ($32-$42 million) is not by any means [...]
Ransomware Attack on Massachusetts Fertility Testing Laboratory Affects 350,000 Patients
The Marlborough, MA-based fertility-related medical laboratory ReproSource Fertility Diagnostics has started [...]
What is 45 CFR § 164.530?
In the Code of Federal Regulations, 45 CFR § 164.530 relates to the administrative requirements of the HIPAA [...]
What is 45 CFR § 164.308?
45 CFR § 164.308 is the section of the Code of Federal Regulations that contains the Administrative [...]
Lawsuit: Baby Died as a Consequence of Hospital Ransomware Attack
A lawsuit has been filed on behalf of a mother of a baby who is alleged to have died as a consequence of a [...]
OCR Issues Advice on HIPAA and Vaccination Disclosures
The introduction of vaccine mandates by employers, especially in healthcare, has raised questions about HIPAA [...]
Study Reveals Large Gaps in Healthcare Security Awareness Training
The number of healthcare data breaches being reported by HIPAA regulated entities has reached record levels. [...]
HHS Appoints New Director of the Office for Civil Rights
Lisa J. Pino, Director, Office for Civil Rights The Department of Health and Human Services has announced a [...]
FTC Confirms Health Apps and Wearable Devices Covered by FTC Health Breach Notification Rule
The HIPAA Breach Notification Rule requires HIPAA-regulated entities to report data breaches and issue [...]
Cloud Security Alliance Issues Guidance on Combatting Ransomware in the Healthcare Cloud
New guidance has recently been released by the Cloud Security Alliance (CSA) Health Information Management [...]
OCR Imposes $80,000 Fine on Nebraska Hospital for HIPAA Right of Action Violation
Children’s Hospital & Medical Center (CHMC) has agreed to settle a HIPAA Right of Access [...]
€225 Million GDPR Fine for WhatsApp for Data Processing Transparency Failures
The second largest ever financial penalty to resolve GDPR violations has been imposed on WhatsApp by the [...]
Scripps Health Ransomware Attack Cost Increases to $112.7 Million
The 2021 IBM Security/Ponemon Institute Cost of a Data Breach Study determined the average cost of a data [...]
NIST Publishes Draft Update of Guidance on Developing Cyber-Resilient Systems
The National Institute of Standards and Technology (NIST) has released a draft version of updated guidance to [...]
French Publisher Fined for GDPR Violations for Installing Cookies Without User Consent
The French Data Protection Authority, Commission Nationale de l’Informatique et des Libertés (CNIL), has [...]
PHI of 447,000 Patients Potentially Compromised in Phishing Attack
Ransomware gangs have increased attacks on the healthcare industry. Data from Emsisoft show 560 healthcare [...]
Low Cybersecurity Risk Ratings Associated with Higher Risk of a Hospital Data Breach
A new study published in the Journal of the American Medical Informatics Association has explored the link [...]
The Importance of HIPAA Security Rule Information Access Management and Access Control Compliance
The HHS’ Office for Civil Rights has recently reminded HIPAA-covered entities and their business associates [...]
Amazon.com Facing €746 Million Fine for Alleged Advertising-Related GDPR Violations
Amazon.com has been slapped with a record-breaking €746 million ($888 million) GDPR penalty for allegedly [...]
Average Healthcare Data Breach Cost Increases to $9.23 Million
According to the 2021 IBM Security Cost of a Data Breach report, the average cost of a data breach has risen [...]
Data Breach Affects up to 2.4 Million Forefront Dermatology Patients
A major data breach has occurred at Wisconsin-based Forefront Dermatology. The protected health information [...]
California has Updated its Medical Data Breach Notification Regulations and Administrative Penalties
California has updated its data breach reporting requirements for healthcare facilities and has also [...]
€2.6 Million GDPR Violation Penalty Imposed on Italian Food Delivery Company
The Italian Data Protection Authority Garante has announced the food delivery company Foodinho has been fined [...]
Ohio Care Coordinator Accessed Patient Records Without Authorization for Almost 12 Years
Accessing the medical records of patients when there is no legitimate work reason for doing is a violation of [...]
Irish Health Service Executive Ransomware Attack Expected to Cost $600 Million
On May 14, 2021, the Health Service Executive (HSE) in Ireland suffered a ransomware attack. The attack was [...]
Ransomware Attack on Eye Clinic Network Affects Half a Million Patients
On February 8, 2021, Wolfe Eye Clinic in Iowa suffered a ransomware attack that resulted in widespread [...]
Amazon Faces $425 Million Financial Penalty for Alleged GDPR Violations
Amazon is facing a $425 million financial penalty for violations of the EU General Data Protection Regulation [...]
President Biden Urged to Provide More Funding and Support to Improve Healthcare Sector Cybersecurity
The recently enacted American Rescue Plan has made funding available to speed the recovery from the pandemic, [...]
PHI of 3,253,822 Individuals Potentially Stolen and Deleted from 20/20 Hearing Care Network’s AWS Environment
The protected health information (PHI) of 3,253,822 current and former members of the 20/20 Hearing Care [...]
OCR Announces 19th HIPAA Right of Access Settlement
The U.S. Department of Health and Human Services’ Office for Civil Rights has fined an endocrine disorder [...]
Litigation a Bigger Concern than GDPR Fines for Most Security Leaders
It has been 3 years since the GDPR took effect and fines for noncompliance are being issued, but most [...]
Can Employers ask Employees about COVID-19 Vaccinations?
In the United States, mask mandates are starting to be lifted and people who have been fully vaccinated [...]
Multiple HIPAA Security Rule Failures Result in $25,000 HIPAA Fine for Clinical Laboratory
The U.S. Department of Health and Human Services’ Office for Civil Rights (OCR) has announced its 7th HIPAA [...]
UHS Data Breach Lawsuit Proceeds for Plaintiff Whose Surgery was Delayed
It is now common for the victims of healthcare data breaches to take legal action against a healthcare [...]
External Actors Now Cause More Healthcare Data Breaches than Insiders
Verizon has published its 2021 Data Breach Investigations Report (DBIR) which shows the majority of [...]
GDPR Fine for Lack of EU Representative a Warning to All Non-EU Companies About Importance of GDPR Compliance
Businesses based collect or process the data of residents of the European Union are subject to the EU’s [...]
NIST Seeks Feedback on HIPAA Security Rule Implementation Guidance
In 2008, the National Institute of Standards and Technology (NIST) released guidance for HIPAA-covered [...]
Montefiore Staff Member Fired for HIPAA Breach; Belden Facing Class Action Suit
Another staff member at New York’s Montefiore Medical Center has been found to have been illegally [...]
Irish DPC Launches GDPR Investigation of Facebook After 533 Million Record Database Dumped Online
The Irish Data Protection Commission has launched an investigation of a potential data breach at Facebook [...]
HB 300 Training
In 2011, House Bill 300 (HB 300) introduced significant changes to the Texas Health and Safety Code including [...]
HHS Information Blocking Regulations are Now in Effect
It has been a long time coming, but the information blocking regulations of the Office of the National [...]
PHI of Almost 3.5 Million Individuals was Compromised in the Accellion Cyberattack
The number of healthcare organizations known to have been affected by the Accellion cyberattack has been [...]
Dutch DPA Fines Booking.com €475,000 for Breach Notification Failure
The Dutch Data Protection Authority (Autoriteit Persoonsgegevens -AP) has fined the online hotel booking [...]
OCR Announces 18th Settlement Under HIPAA Right of Access Enforcement Initiative
The U.S. Department of Health and Human Services’ Office for Civil Rights has announced its 18th settlement [...]
Massachusetts Hospital Pays $65,000 Penalty to Settle HIPAA Right of Access Case
The HHS’ Office for Civil Rights has fined Arbour Hospital $65,000 for failing to provide a patient with [...]
How Often is HIPAA Training Required?
Every HIPAA-covered entity is required to implement policies and procedures to ensure compliance with the [...]
Medical Debt Collection Firm Settles Data Breach Case with Coalition of 41 State AGs
In 2019, the largest reported healthcare data breach was at American Medical Collection Agency (AMCA), a debt [...]
Vodafone Spain Hit with €8.15 Million GDPR Fine
Last week, the Spanish data protection authority – Agencia Española de Protección de Datos [...]
Can Employees Who Violate HIPAA Rules Be Terminated?
The HIPAA Enforcement Rule gave the HHS’ Office for Civil Rights the authority to penalize healthcare [...]
How Often Do You Need HIPAA Training?
How Often Do You Need HIPAA Training? Considering the importance of HIPAA compliance and the potential [...]
Comment Period on Proposed HIPAA Privacy Rule Changes Extended Until May 6, 2021
On December 10, 2020, the Department of Health and Human Services published a Notice of Proposed Rulemaking [...]
Small and Medium Sized Healthcare Organizations Targeted by Ransomware Gangs
Ransomware gangs stepped up their attacks on healthcare organizations in 2020 with some ransomware operations [...]
Four Areas of HIPAA That Are Important to Patients
The Health Insurance Portability and Accountability Act of 1996 or HIPAA was signed into law by Pres. Bill [...]
What is the Proper Response to an Accidental HIPAA Violation?
The HIPAA Rules must be followed by HIPAA covered entities, business associates and all healthcare employees. [...]
Georgia Man Jailed for Attempting to Frame Nurse for Fake HIPAA Violations
This month, a U.S District Court judge for the Southern District of Georgia has sentenced a man for making [...]
HHS Announces Limited Waiver of HIPAA Fines and Sanctions in in Texas Due to Winter Storm
Norris Cochran, the Acting Secretary of the Department of Health and Human Services, has declared a public [...]
Reporting an Anonymous HIPAA Violation Complaint
Although it is illegal for a Covered Entity to intimidate, threaten, coerce, discriminate, or retaliate [...]
Amsterdam Hospital Fined €440,000 for Failing to Implement 2FA and Insufficient Checks of Access Logs
OLVG hospital Amsterdam has been fined €440,000 by the Dutch Data Protection Authority (DPA) – [...]
OCR Announces $70,000 Settlement with Sharpe Healthcare to Resolve HIPAA Right of Access Case
Sharpe Healthcare has agreed to settle a HIPAA violation case with the Department of Health and Human [...]
Florida Health Insurer Discovers Breach of the PHI of 3.5 Million Individuals
One of the largest ever healthcare data breaches has recently been reported by the Florida-based health [...]
OCR Announces Fifteenth Settlement Under its HIPAA Right of Access Enforcement Initiative
The HHS’ Office for Civil Rights (OCR) has agreed to settle a HIPAA Right of Access enforcement action [...]
FTC Finalizes Settlement with SkyMed International to Resolve Allegations of Security and Data Breach Response Failures
The Federal Trade Commission (FTC) has announced the settlement with SkyMed International has been finalized [...]
GDPR Financial Penalties 39% Higher Than Total for the Previous 20 Months
The number of financial penalties imposed to resolve violations of the General Data Protection Regulation [...]
Grindr Fined €9.6 Million for Data Sharing GDPR Violation
Grindr, the world’s largest dating and social networking app for gay, bi, trans, and queer people, has been [...]
HIPAA Enforcement Discretion for Good Faith Use of Online or Web-based Scheduling Applications for COVID-19 Vaccination Appointments
The Office for Civil Rights (OCR) of the Department of Health and Human Services has announced it will be [...]
$4.3 Million HIPAA Penalty for MD Anderson Cancer Center Vacated by Court of Appeals
The 5th Circuit U.S. Court of Appeals in Louisiana has vacated the civil monetary penalties imposed on the [...]
Excellus Health Plan Hit with $5.1 Million Penalty for 10 Million-Record Data Breach
Excellus Health Plan has settled a HIPAA violation case with the HHS’ Office for Civil Rights and has [...]
What is the HIPAA “Minimum Necessary” Standard?
The HIPAA “Minimum Necessary” standard is an important provision of HIPAA and one that all employees of [...]
HHS Announces Largest Ever Financial Penalty for HIPAA Right of Access Failure
The U.S. Department of Health and Human Services has issued its largest ever HIPAA fine for noncompliance [...]
What is Considered as PHI Under HIPAA?
In the healthcare industry, health information is often spoken of as protected health information or PHI, but [...]
Safe Harbor Introduced for Covered Entities That Adopt Recognized Cybersecurity Best Practices
HIPAA covered entities and their business associates have been provided with a degree of protection against [...]
GDPR Violation Penalties in 2020 Totaled €171.3 Million
The online financial news and analysis portal Finbold has published a report detailing the GDPR violation [...]
What is the Purpose of HIPAA?
The Health Insurance Portability and Accountability Act of 1996 – or HIPAA for short – is a vital [...]
NIST Releases Final Guidance on Securing the Picture Archiving and Communication System (PACS)
The National Cybersecurity Center of Excellence (NCCoE) at the National Institute of Standards and Technology [...]
OCR Announces 13th HIPAA Right of Access Settlement
In 2019, the Department of Health and Human Services’ Office for Civil Rights announced a new HIPAA [...]
OCR Confirms Allowable Disclosures of ePHI to Health Information Exchanges for Public Health Purposes
The HHS’ Office for Civil Rights has issued new guidance to help HIPAA covered entities and their business [...]
2016/2017 HIPAA Compliance Audit Findings Published by HHS’ Office for Civil Rights
The long-awaited report from the Department of Health and Human Services’ Office for Civil Rights on the [...]
Dental Care Alliance Cyberattack Impacts More Than 1 Million Patients
The protected health information of more than a million dental patients has potentially been obtained by [...]
More Than 45 Million Medical Images Containing PHI Stored on Unprotected Servers
A study conducted by the cybersecurity firm CyberAngel has revealed more than 45 million medical images are [...]
Twitter Fined €450,000 For GDPR Breach Notification Failure
The Irish Data Protection Commission (DPC) has concluded its GDPR investigation into Twitter and has [...]
Vodafone Italy Slapped with €12.25 Million GDPR Fine
Vodafone Italy has received a €12.25 million GDPR financial penalty from the Italian Data Protection [...]
HIPAA Privacy Rule Updates Proposed by HHS
They have been a long time coming, but the Department of Health and Human Services has finally revealed a [...]
Carrefour Fined €3 Million by French DPA for Multiple GDPR Violations
Carrefour has received a €3.25 million GDPR violation penalty from the French data protection authority, [...]
EU Proposes Data Governance Act – A GDPR Framework for Industrial and Government Data
The EU General Data Protection Regulation (GDPR) gave EU citizens new rights over their personal data. It has [...]
OCR Fines University of Cincinnati Medical Center $65,000 for Failure to Provide Patient’s Medical Records
The University of Cincinnati Medical Center (UCMC) has been fined $65,000 by the HHS’ Office for Civil [...]
OCR Announces 11th Financial Penalty under HIPAA Right of Access Enforcement Initiative
A Regal Park, NY-based private otolaryngology practitioner has been issued with a $15,000 financial penalty [...]
10th Financial Penalty Announced Under OCR’s HIPAA Right of Access Enforcement Initiative
The HHS’ Office for Civil Rights has made good on its promise to step up enforcement of compliance with the [...]
ShopRite Data Breach Results in $235,000 HIPAA Penalty for Wakefern Food Corporation
New Jersey Attorney General General Gurbir S. Grewal and the New Jersey Division of Consumer Affairs have [...]
City of New Haven Settles HIPAA Violation Case with OCR for $202K
The City of New Haven in Connecticut has settled a HIPAA violation case with the U.S. Department of Health [...]
Marriot International Slapped with £18.4 Million GDPR Fine for Data Breach
In July 2019, the UK Information Commissioner’s Office (ICO) announced its intention to fine Marriott [...]
Aetna Pays $1,000,000 Penalty to Resolve Multiple Violations of the HIPAA Rules
The health plan Aetna, part of the Aetna Life Insurance Company, has agreed to pay a $1 million penalty to [...]
British Airways £184 Million GDPR Fine Reduced to £20 Million
The UK’s Information Commissioner’s Office (ICO) has announced that the General Data Protection [...]
$100,000 Financial Penalty Imposed on NY Spine for HIPAA Right of Access Failure
In 2019, the U.S. Department of Health and Human Services’ Office for Civil Rights launched its HIPAA Right [...]
Community Health Systems Settles Data Breach Case with 28 State Attorneys General for $5 Million
Tennessee Attorney General Herbert H. Slatery III has announced a $5 million settlement has been reached with [...]
OCR Issues 8th HIPAA Penalty Under HIPAA Right of Access Enforcement Initiative
The Department of Health and Human Services’ Office for Civil Rights has imposed its 8th HIPAA penalty on a [...]
H&M Slapped with €35.2 Million GDPR Fine for Excessive Use of Employee Data
H&M, the second largest fashion retailer in the world, has been fined €35,258,707.95 ($41.2 million) [...]
Anthem Settles Multi-State Action with State Attorneys General Over 2014 Data Breach
A multi-state investigation by attorneys general in 42 states and Washington D.C. over the 78.8 million [...]
Premera Blue Cross to Pay $6.8 Million OCR HIPAA Fine for 2014 Data Breach
The HHS’ Office for Civil Rights (OCR) has imposed its second largest ever HIPAA violation penalty – [...]
$2.3 Million HIPAA Penalty for Business Associate for 6 Million-Record Data Breach
The Community Health Systems business associate, CHSPSC LLC, has settled its HIPAA violation case with the [...]
Athens Orthopedic Clinic Agrees to Pay $1.5 Million to Settle OCR HIPAA Violation Case
The Department of Health and Human Services’ Office for Civil Rights (OCR) has settled another HIPAA [...]
Gartner Predicts 65% of Countries will have Data Privacy Legislation by 2023
The EU General Data Protection Regulation (GDPR) has now been in effect for more than 2 years and while this [...]
OCR Settles 5 More HIPAA Right of Access Cases
In 2019, the HHS’ Office for Civil Rights launched an enforcement initiative targeting organizations that [...]
Irish DPC Orders Facebook to Stop Transfers of EU Citizens’ Data to the US
The Irish Data Protection Commission (DPC) has issued a preliminary order calling for Facebook to cease [...]
Americans Largely Unaware of Extent that Health Insurers Access their Online Data
A recent MITRE-Harris poll has revealed most Americans are unaware of the extent to which health insurers are [...]
September is National Insider Threat Awareness Month
September is National Insider Threat Awareness Month – A month dedicated to raising awareness of the [...]
OCR Updates mHealth Portal Adding New Resources for HIPAA Health App Developers
In certain circumstances, the developers of mobile health apps are classed as business associates and are [...]
Malicious Activity Detection and Mitigation Guidance Published by CISA
The HIPAA Security Rule requires covered entities and their business associates to implement safeguards to [...]
Before You Can Safeguard PHI, You Must Know Where it is Located
HIPAA-covered entities and their business associates are required to implement safeguards to ensure the [...]
Health Plans Added to June 2020 OCR Plasma Donation Guidance
In June 2020, the U.S Department of Health and Human Services (HHS) issued guidance explaining how HIPAA [...]
Medical Data Being Exposed via Public GitHub Repositories
Research recently published in a collaborative report by security researcher Jelle Ursem and DataBreaches.net [...]
Class Action Lawsuit Alleges Oracle and Salesforce are Violating the GDPR
A class action lawsuit has been filed in Amsterdam by the consumer privacy organization, The Privacy [...]
House of Representatives Votes to Remove Ban on HHS Funding National Patient Identifier System
For the second successive year, the U.S House of Representatives has voted to remove the ban on the [...]
OCR Issues Warning About Misleading Postcards Sent to Compliance Officers About HIPAA Security Risk Assessments
The Department of Health and Human Services’ Office for Civil Rights has issued an alert about a potential [...]
Lifespan Health System Slapped with $1 Million Fine for Noncompliance with the HIPAA Rules
For the second time in a week, the HHS’ Office for Civil Rights (OCR) has announced a fine has been imposed [...]
HHS Reviews COVID-19 Situation and Extends Public Health Emergency for Further 90 Days
On January 31, 2020, the Secretary of the Department of Health and Human Services declared the outbreaks of [...]
$25,000 Penalty for Small Healthcare Provider for HIPAA Security Rule Failures
The Department of Health and Human Services’ Office for Civil Rights (OCR) has agreed to settle a HIPAA [...]
914,000 Patients Impacted by Hacking of Florida Orthopedic Institute and Benefit Recovery Specialists
The protected health information of 914,000 patients has potentially been compromised in two hacking [...]
HHS Makes Changes to 42 CFR Part Substance Use Disorder Privacy Provisions
The Department of Health and Human Services Substance Abuse and Mental Health Administration (SAMHSA) has [...]
At Least 365K Patients Impacted by Magellan Health Ransomware Attack
In April 2020, the Fortune 500 firm Magellan Health experienced a ransomware attack that resulted in [...]
Is Google Voice HIPAA Compliant?
Can healthcare providers and their employees utilize Google Voice? Is this telephony service HIPAA compliant? [...]
GDPR Evaluation Report Hails GDPR a Success, But More Work Required
The European Commission, the executive body of the European Union, has published its first GDPR evaluation [...]
Telehealth Policy Changes Could Become Permanent When COVID-19 Public Health Emergency Ends
If there is one good thing to come out of the COVID-19 pandemic it is the changes that have been made to [...]
Reports of COVID-19 Diagnoses by Media Suggest Violations of HIPAA
When famous people are diagnosed with an illness or suffer an accident, that can be headline news. The Health [...]
Episcopal Health Services Data Breach Lawsuit Sent Back to State Court for Further Proceedings
A lawsuit filed against Episcopal Health Services following a phishing attack that exposed the protected [...]
Hungarian Data Protection Authority Issues Record-Breaking GDPR Fine
The Hungarian Data Protection Authority (NAIH) has imposed a record-breaking financial penalty under the [...]
Hungary Suspends Data Subjects’ Rights Under GDPR During COVID-19 Pandemic
The government in Hungary has taken the controversial decision to suspend the rights of data subjects under [...]
OCR Issues Guidance on Contacting Former COVID-19 Patients About Blood and Plasma Donations
The Department of Health and Human Services’ Office for Civil Rights has issued new HIPAA guidance to clear [...]
Guidance Issued by HSCC and H-ISAC on Managing the Cybersecurity Tactical Response During a Pandemic
Joint guidance on managing the cybersecurity tactical response has recently been published by the Healthcare [...]
PHI of 170,000 Patients Potentially Compromised in Recent Phishing Attacks
Monthly breach reports show that email is the most common location of breached protected health information. [...]
FTC Seeks Feedback on the Health Data Breach Notification Rule
The Federal Trade Commission is seeking feedback from healthcare industry stakeholders about its breach [...]
Dutch DPA Issues €750,000 GDPR Fine for Improper Use of Biometric Data
The Data Protection Authority in the Netherlands has imposed a financial penalty of €725,000 ($791,000) on [...]
CISA and NCSC Issue Joint Cybersecurity Alert About Ongoing Cyberattacks on Healthcare Organizations
Advanced Persistent Threat (APT) groups are continuing to exploit the SARS-CoV-2 (COVID-19) pandemic and are [...]
Film Crews Not Permitted in Hospitals Unless HIPAA Authorizations are Obtained from Patients, Warns OCR
Hospitals have been warned that they must not allow film crews into parts of hospitals where there is [...]
HHS Delays Enforcement of Information Sharing and Interoperability Rules
The new interoperability and data sharing rules that were announced by the HHS on March 9, 2020 were due to [...]
HHS Issues Notice of Enforcement Discretion for COVID-19 Community-Based Testing Sites
The Department of Health and Human Services’ Office for Civil Rights (OCR) has issued a Notice of [...]
Brave Software Inc. Files Complaint Over Alleged Google GDPR Violation
Brave Software Inc., developer of the Brave web browser, has filed a GDPR compliant with the Irish Data [...]
FBI Warns About COVID-19 Cyberattacks and Healthcare Providers Targeted by Individuals Posing as OCR Investigators
The Federal Bureau of Investigation (FBI) has issued a fresh warning about the use of the 2019 Novel [...]
OCR Announces Enforcement Discretion for Business Associate Uses and Disclosure of PHI
On April 2, 2020, the Department of Health and Human Services’ Office for Civil Rights (OCR) issued another [...]
COVID-19 and HIPAA Guidance on Disclosures of PHI to First Responders
The HHS’ Office for Civil Rights has issued guidance on COVID-19 and HIPAA about the permitted disclosures [...]
OCR Issues Guidance on Telehealth Services During COVID-19 Public Health Emergency
Last week, the Trump Administration extended Medicare telehealth services as the COVID-19 crisis deepened. [...]
2019 Novel Coronavirus and HIPAA Compliance
Important information on the 2019 Novel Coronavirus and HIPAA compliance, the limited HIPAA waiver announced [...]
Google Fined $8 Million by Swedish Data Protection Authority
The Swedish Data Protection Authority has announced it has imposed a SEK 75 million fine on Google for right [...]
HHS Publishes Final Interoperability, Information Blocking, and Data Sharing Rules
The U.S. Department of Health and Human Services has released its final interoperability, information [...]
Medical Devices Affected by SweynTooth Vulnerabilities, Warns FDA, CISA
The U.S. Food and Drug Administration (FDA) and the Department of Homeland Security’s Cybersecurity [...]
$100,000 HIPAA Fine Imposed on Physician Practice for Security Rule Violations
A $100,000 HIPAA fine has been imposed on a solo physician practice for HIPAA Security Rule failures [...]
Analysis of 2019 Healthcare Data Breaches
A recent analysis of 2019 healthcare data breaches by Protenus has confirmed that 2019 was a particularly bad [...]
Widespread E1 Transactions Violations Discovered by HHS’ Office of Inspector General
A recent audit of a mail-order pharmacy and 29 other healthcare provides by the Department of Health and [...]
HIPAA Email Retention Policy
While email retention is not specifically mentioned in the HIPAA text, certain provisions cover data [...]
HHS Modifies Pharmacy HIPAA Transaction Requirements for Partially Filled Schedule II Drug Prescriptions
The Department of Health and Human Services (HHS) has issued a final rule modifying the pharmacy HIPAA [...]
Irish DPC Launches GDPR Compliance Investigations into Google and Tinder
The Data Protection Commission in Ireland, the country’s lead GDPR regulator, has launched investigations [...]
Fee Limitations on Requests to Send Patient Records to Third Parties Lifted
Following a ruling in a federal court that went against the U.S. Department of Health and Human Services, the [...]
HIPAA Subpoena for Medical Records: What You Need to Know
A HIPAA subpoena for medical records is an area where there is considerable potential for a HIPAA violation. [...]
HIPAA Compliant Website Requirements
What are the requirements for a HIPAA compliant website? Here we list the important elements when setting up [...]
Immediately Patch Windows Vulnerabilities Warns DHS and OCR
On January 14, 2020 Microsoft issued patches to correct critical vulnerabilities in Windows and Windows [...]
London Pharmacy Hit With £275,000 GDPR Penalty
The Information Commissioner’s Office (ICO), the UK’s GDPR data protection authority, has issued its [...]
HIPAA Compliance Failures Result in $65,000 Fine for Georgia Ambulance Company
West Georgia Ambulance, Inc., an ambulance company serving Carroll County in Georgia, has agreed to settle a [...]
Is Office 365 HIPAA Compliant?
The question of whether or not Office 365 is HIPAA compliant has recently been clouded by the rebranding of [...]
OCR Issues Second Fine for Noncompliance with HIPAA Right of Access
The Department of Health and Human Services’ Office for Civil Rights has announced another settlement has [...]
How Does DNS Filtering Work?
In this post we answer some commonly asked questions about content filtering, such as what is DNS filtering?, [...]
New Federal Privacy and Data Protection Legislation Introduced
Currently there is no federal privacy and data protection law in the United States, only a patchwork of [...]
German Telecoms Company Gets $10.6 Million Fine for Noncompliance with GDPR
The German data protection authority has imposed one of the largest ever GDPR fines on a telecommunications [...]
Is Google Forms HIPAA Compliant?
Google Forms is a survey administration tool that allows forms to be created for data collection purposes, [...]
Breach Notification Rule Failure Leads to $2.175 Million HIPAA Settlement
A breach notification failure and the lack of a business associate agreement has led to a $2.175 million [...]
20 Common HIPAA Myths Debunked
In this post we cover some of the many HIPAA myths that have been circulating on the internet and often get [...]
German Real Estate Company Issued with €14.5 Million GDPR Fine for Unlawful Data Retention
A German real estate company, Deutsche Wohnen SE, has been issued with a €14.5 million GDPR penalty by the [...]
OCR Makes Inflation Adjustment to HIPAA Civil Monetary Penalties
The Office of the Assistant Secretary for Financial Resources (ASFR), Department of Health and Human [...]
OCR Imposes $1.6 Million Civil Monetary Penalty on Texas Health and Human Services Commission for HIPAA Violations
The Department of Health and Human Services’ Office for Civil Rights (OCR) has fined another HIPAA-covered [...]
Failure to Encrypt ePHI on Portable Devices Results in $3 Million Financial Penalty
The HHS’ Office for Civil Rights (OCR) has announced its sixth HIPAA penalty of 2019. The University of [...]
Updated Security Risk Assessment Tool Released to Help Covered Entities with HIPAA Security Rule Compliance
The Department of Health and Human Services’ Office for Civil Rights (OCR) has released an updated version [...]
Study Suggests Security Enhancements After a Hospital Data Breach Negatively Affects Patient Outcomes
Following a data breach, hospitals implement additional measures to improve their security posture and make [...]
9 Unsecured Medical Databases Found Containing Millions of Patient Records
Security researchers at Wizecase have discovered 9 medical databases containing millions of patient records [...]
Jackson Health System Pays $2.15 Million Penalty for Widespread Noncompliance with HIPAA Rules
Jackson Health System (JHS) has paid a $2.15 million civil monetary penalty to the HHS’ Office for Civil [...]
More Financial Penalties for HIPAA Right of Access Compliance Failures Expected
At the OCR/NIST HIPAA Security Conference in Washington D.C., the Director of the Department of Health and [...]
Dental Practice Gets $10,000 HIPAA Penalty for PHI Disclosures on Social Media
A dental practice has been fined $10,000 by the HHS’ Office for Civil Rights for violating Health Insurance [...]
Poland Issues €645,000 GDPR Penalty for Lack of Organizational and Technical Safeguards
Poland’s Personal Data Protection Office has issued a PLN 2.8 million (€645,000) GDPR penalty to an [...]
HIPAA Right of Access Failure Attracts $85,000 Financial Penalty
The HHS’ Office for Civil Rights has announced the first HIPAA settlement under its HIPAA Right of Access [...]
Senate Stalls on Lifting of Ban on Funding National Patient Identifier System
The Health Insurance Portability and Accountability Act of 1996 called for the Department of Health and Human [...]
400 Million Medical Images Found to Be Freely Accessible Over the Internet
A recent investigation by ProPublica, Greenbone Networks, and the German public broadcaster Bayerischer [...]
Guidance Issued on Securing Picture Archiving and Communications Systems
New guidance has been released by the National Cybersecurity Center of Excellence (NCCoE) on securing picture [...]
Complaint Submitted to Irish DPC over Alleged Google GDPR Workaround
Google is alleged to have been using a ‘GDPR workaround’ to avoid the restrictions on data sharing [...]
Guidance on Securing Corporate-Owned Personally Enabled Devices in Healthcare
and transmit patient information. They ensure healthcare professionals are always contactable and can quickly [...]
HHS Proposes Changes to Ease Restrictions on Part 2 Substance Abuse Disorder Treatment Records
A new rule has been proposed by the Substance Abuse and Mental Health Services Administration (SAMHSA) that [...]
HHS Issues Guidance on Managing Malicious Insider Threats
The Department of Health and Human Services’ Office for Civil Rights has issued guidance for HIPAA-covered [...]
Summary of July 2019 Healthcare Data Breaches
It has been another terrible month for healthcare data breaches – The worst of the year to date in terms of [...]
Third of Healthcare Employees Have Received No Cybersecurity Training
A new Kaspersky Lab study has shed light on why healthcare organizations are so susceptible to data breaches. [...]
Sweden Issues First GDPR Fine to School Over Use of Facial Recognition Technology to Monitor Attendance
Swedish high school has been fined €19,000 for violations of the EU Data Protection Regulation (GDPR) [...]
51% of Healthcare Providers Are Not Fully Compliant with HIPAA Right of Access
Healthcare providers are providing patients with copies of their medical records, but a majority have been [...]
$74 Million Premera Blue Cross Settlement Gets Preliminary Approval
A consolidated class action lawsuit against Premera Blue Cross over its 2014 data breach of 10.6 million [...]
$145 Settlement Proposed by Allscripts to Resolve HIPAA and Anti-Kickback Case
Allscripts Healthcare Solutions has proposed a settlement of $145 million to resolve alleged violations of [...]
National Association of Attorneys General Urges Congress to Align Part 2 with HIPAA
The National Association of Attorneys General (NAAG) has written to Congress demanding changes be made to [...]
AMCA Breach Victim Count Nears $24 Million
Over the past 10 days, several more healthcare providers have announced that they have been affected by the [...]
Premera Blue Cross Settles HIPAA Case for $10 Million
Premera Blue Cross has agreed to settle its HIPAA violation lawsuit and pay a $10 million penalty to resolve [...]
31% of EU Citizens Have Not Heard of GDPR
May 25, 2019 was the first anniversary of the compliance date of the EU’s General Data Protection [...]
British Airways Handed Record £183 Million GDPR Penalty
The UK GDPR supervisory authority has issued the largest ever GDPR financial penalty to date. British Airways [...]
OCR Publishes New HIPAA FAQ for Health Plans on Care Coordination and Continuity of Care PHI Disclosures
New HIPAA guidance for health plans has been published by the Department of Health and Human Services’ [...]
Unauthorized Medical Record Access and Disclosure Results in 1 Year Jail Term
The penalties for HIPAA violations are usually restricted to fines for the covered entity or business [...]
Almost 2 Million Records Exposed in May 2019 Healthcare Data Breaches
It has been another bad month for the U.S. healthcare industry. Rather than April’s record number of [...]
AMCA Files for Bankruptcy Following Massive Data Breach
After 42 years in business, the parent company of American Medical Collections Agency (AMCA) has sought [...]
Businesses Risk GDPR Fines Over Continued Use of Unencrypted USB Devices
Under GDPR, businesses must ensure that any personal data of EU residents that is collected or processed is [...]
More Than 20 Million Individuals Impacted by AMCA Data Breach
The number of individuals affected by the data breach at American Medical Collections Agency (AMCA) continues [...]
PHI of 11.9 Million Quest Diagnostics Patients Compromised in AMCA Data Breach
Quest Diagnostics, one of the largest medical laboratory chains in the United States, has announced that [...]
EHR Provider to Pay $900,000 to Resolve Multi-State HIPAA Case
Just a few days after the HHS’ Office for Civil Rights announced a settlement had been reached with Medical [...]
HHS Confirms When Business Associates Can be Held Directly Liable for HIPAA Violations
The Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009, and the subsequent [...]
Medical Informatics Engineering Issued with $100,000 HIPAA Violation Penalty
The Department of Health and Human Services’ Office for Civil Rights has announced a settlement has been [...]
April 2019 Was the Worst Ever Month for Healthcare Data Breaches
April was a record-breaking month for healthcare data breaches. More data breaches were reported by [...]
Large GDPR Fines for Noncompliance Expected in 2019
It has almost been a full year since compliance with the EU’s General Data Protection Regulation (GDPR) has [...]
High Severity Wormable Windows Vulnerability Patched by Microsoft
The UK’s National Cyber Security Centre has reported a critical vulnerability to Microsoft which could [...]
Multiple HIPAA Violations at Medical Imaging Services Company Result in $3 Million Penalty
Touchstone Medical Imaging, a Franklin, Tennessee-based provider of medical imaging services, has agreed to [...]
OCR Issues New Advice on HIPAA and Software Applications Used by Patients to Access PHI
The Department of Health and Human Services’ Office for Civil Rights (OCR) has issued new advice on HIPAA [...]
HHS Changes Maximum Penalties for HIPAA Violations
The Department of Health and Human Services (HHS) has made changes to the maximum penalties for HIPAA [...]
CMS Starts HIPAA Simplification Rules Audits
The Centers for Medicare and Medicaid Services (CMS) Division of National Standards has recently announced [...]
Study Reveals Widespread Nonconformance with HIPAA Rules and NIST CSF Controls
It has been 14 years since the HIPAA Security Rule requirements have been mandatory, but many healthcare [...]
Deadline Extended for Comments on HHS Health IT and ePHI Interoperability Rules
New rules were published by the Department of Health and Human Services’ Office of the National Coordinator [...]
912,992 Records Exposed in Healthcare Data Breaches in March 2019
February was a particularly bad month for healthcare data breaches, so it is no surprise there was a fall in [...]
GDPR Compliance Has Helped to Reduce Data Breaches in the UK
The UK government has released the results of its annual cybersecurity breach survey which shows a fall in [...]
G2 Crowd Releases Spring 2019 Secure Email Gateway Performance Report
G2 Crowd has released its Spring 2019 G2 Crowd Secure Email Gateway Performance Report. The report highlights [...]
PHI of 12,000 Baystate Health Patients Exposed Due to Phishing Attack
A phishing attack on Baystate Health in Massachusetts has exposed the protected health information (PHI) of [...]
Improving Healthcare Organizations Cybersecurity Through Cross-sector and Bi-partisan Collaboration
On February 21, 2019, Sen. Mark Warner (D-Va) requested feedback from a number of healthcare organizations [...]
1,600 Ohio Patients Impacted by Impermissible Disclosures of PHI
993 Ohio residents who are beneficiaries of Medicaid or have received services from the Ohio Department of [...]
PHI Compromised Due to Emotet Malware Attack on Oregon Endodontic Group and Humana Web Portal Breach
An office computer used by Oregon Endodontic Group has been infected with malware, which may have allowed [...]
New HIPAA-Compliant Alexa Skills Announced
Amazon has announced six new HIPAA compliant Alexa skills have been developed and that the platform can [...]
PHI of 14,305 Patients Exposed Due to a Phishing Attack on Main Line Endoscopy Centers
Main Line Endoscopy Centers, a network of outpatient endoscopy clinics in the Malvern, Media and Bala Cynwyd [...]
Sharp Grossmont Hospital Faces Lawsuit For Video Recording Patients During Gynecology Procedures
Sharp HealthCare and Sharp Grossmont Hospital have been accused of covertly recording videos in an area of [...]
Alert on Advanced Persistent Threats and Zero-Day Exploits Issued by OCR
In its spring cybersecurity newsletter, the HHS’ Office for Civil Rights has warned healthcare [...]
Health Data is the Least Likely Type of Data to Use Encryption
The Ponemon Institute conducted a survey for the Global Encryption Trends Study on behalf of nCipher, a [...]
National Board of Examiners in Optometry to Pay $3.25 Million to Settle 2016 Data Breach Lawsuit
A class action lawsuit that was filed on behalf of victims of a 2016 data breach at the National Board of [...]
Michigan Practice to Close Down Due to Ransomware Attack
A ransomware attack on Brookside ENT and Hearing Center located in Battle Creek prompted the Michigan [...]
Amazon Developed a New System for the De-identification of Medical Images
Amazon recently announced a new system has been launched which can identify the protected health information [...]
Security Breaches Reported by DePaul and Southern Hills Eye Care
DePaul is informing a number of its behavioral health program patients about the exposure of their protected [...]
PHI of 67,493 Burrell Behavioral Health Patients Exposed Due to Business Associate Breach
Burrell Behavioral Health is informing 67,493 patients about the accidental exposure of their healthcare [...]
Class Action Lawsuit Filed Against UnityPoint Health for February 2018 Data Breach
A class action lawsuit has been filed against UnityPoint Health over a data breach that exposed 16,429 [...]
Harvard Business Review Shares Lessons from the Massive Marriott Data Breach
A Harvard Business Review report has been released on the most recent massive data privacy breach involving a [...]
Microsoft CEO Supports Global Enactment of GDPR-Like Legislation
In a recent interview at World Economic Forum in Davos Switzerland, Microsoft CEO Satya Nadella spoke about [...]
Texas Department of Aging and Disability Services To Pay $1.6 Million Settlement Over 2015 Data Breach
The Department of Health and Human Services’ Office for Civil Rights and the Texas Department of Aging and [...]
Healthcare Industry Ranks 8th for Cybersecurity But Must Improve DNS Health and Endpoint Security
By means of complying with HIPAA, healthcare providers have attained a baseline standard of security. [...]
PHI Exposure of Superior Dental Care Patients and L.A. Care Health Plan Members
The dental insurance provider, Superior Dental Care, based in Centerville, Ohio, has discovered an [...]
Copyright © 2007-2022 The HIPAA Guide Site Map Privacy Policy About The HIPAA Guide