HIPAA Blog

Another law firm breached and sued: This time, it's Wilmer Hale .  

Security Rule Update Delayed: The likely effective date of the proposed revisions to the HIPAA Security Rule to increase encryption, MFA, an...

AI Usage Generally Requires a BAA: If you are a covered entity and you use any AI product, keep one thing in mind: if that AI product touch...

It happens to everyone, even lawyers: The biglaw firm Blank Rome was hit with a couple of class action lawsuits over a May data breach in w...

Law Firm Data Breaches Surge: While few of these are specifically HIPAA related (law firms can be business associates of covered entities, ...

 You already knew this, but the healthcare sector is still the industry most targeted for cybersecurity incidents .  Large amounts of data, ...

 Epic Ramps Up the Fight: It appears that Epic is not happy simply rousing up some of its customers to sue Health Gorilla regarding potenti...

NoPP Changes Due February 16:  You've likely seen plenty of law firms and others noting that HIPAA covered entities need to make change...

OCR Chief Paula Stannard: My friend and reporter Theresa Defino recently interviewed Paula Stannard, the (new-ish) current Director of HHS...

Check out OCR's January 2026 Cybersecurity Newsletter.   A link is here . The tips focus on system hardening, but most of the recommenda...

"Part 2" Providers: Don't Forget to Update Your NoPPs by February 16.  Are you a "Part 2" provider?  If you don...

A Couple of Articles on Healthcare Data Breaches for 2025:    1. Data breaches in the healthcare industry are more expensive , at an average...

The Evolving Threat of Ransomware in Healthcare: Attackers are getting faster, and ransomware software is getting trickier and cheaper, but ...

It's not just healthcare providers who suffer data breaches: I've been keeping up a stack of law firm data breaches, meaning to wri...

  Healthcare wins again:  Once again, the healthcare industry was the most affected industry when it came to data breaches in 2024.  Many r...

HHS' OCR, Asst. Secretary for Health Policy Release Latest Version of Security Risk Analysis Tool: If you've followed HIPAA much, y...

OCR Named Enforcement Agency for Part 2: When HIPAA was first passed, the Privacy Rule was to be enforced by the Office for Civil Rights wit...

Costs of a Data Breach: According to an IBM study , for the year ended February 2025, an average healthcare data breach costs almost $7.5 m...

400 Large Breaches so far in 2025: HHS has announced that during the first six months of 2025, there were 400 "large" breaches (...

Let's catch up on some recent HIPAA enforcement actions: Deer Oaks , a HIPAA covered healthcare provider that provides behavioral health...

Finally!! Biden Administration's HIPAA Abortion Stupidity Negated: As I previously wrote about at length, the asinine Biden Administrat...

Happy Memorial Day! Sorry I've not posted in forever, and when I do it's few and far between, but it has been a very busy spring and...

Kettering Health (Ohio) Ransomware Event: Kettering Health, which operates 9 hospitals and a handful of other sites in and around Dayton, O...

Email As a Data Breach Vector:  Almost 200 healthcare organizations suffered a cyberbreach involving their email systems over the last year...

Information-blocking news: EMR company must allow client's BAs to access PHI:  I must admit I haven't been following this at all, bu...

PE-owned healthcare entities need to improve cybersecurity: I hate to say it, but at this point cybersecurity protections are more importan...

Warby Parker Pays $1.5 to Settle HIPAA Violation I wasn't involved in this matter , so I don't have inside information and I'm j...

Change Healthcare's Breach Victim Count Reaches 190,000,000.   US population is about 340 million, which means the breach affected about...

Texas Health and Human Services Commission Suffers HIPAA Breach: If you haven't figured it out yet, anyone with health data is potential...

PHI Deletion Nets $337,750 Fine: This is a bit of an odd one: a Florida HIPAA business associate, USR Holdings, discovered that an unauthori...

9th Ransomware Case: Virtual Private Network Solutions:   HHS has entered into a settlement agreement with a HIPAA business associate who wa...

OCR's January 2025 "Dear Colleague" letter (slightly off-topic): As you know, the Office for Civil Rights is the HIPAA enforce...

HHS Issues 8th Fine Related to Ransomware:   Elgon Information Systems has agreed to an $80,000 settlement with OCR in relation to a ransomw...

Recent OCR Enforcement Actions:  I've been pretty lazy on the blogging front lately, and let a bunch of items stack up, particularly no...

Biden Administration Proposes New Cybersecurity Requirements for Healthcare Organizations: Encryption and network compliance checks are inc...

Ascension breach affects 5.6 million: Ascension Health's May 2024 ransomware incident may have c ompromised PHI of 5.6 million people ,...

  OCR and Abortion: If you're wondering if OCR is going to try to jump into enforcement actions of the soon-to-be-implemented (and likel...

The Blinding, Amazing Stupidity of Xavier Becerra's HHS.   OK, there are plenty examples of this, but the one I'm wrestling with rig...

Ransomware is the Biggest HIPAA Issue Facing the Healthcare Industry: According to a survey recently conducted by Sophos , 67% of all healt...

Recent Ransomware settlement:  OK, I've sort of fallen down on the job here keeping the HIPAABlog updated, but I'm going to try to d...

Providence Medical Institute Ransomware Fine: Providence Medical Institute has been fined $240,000 by OCR for HIPAA violations in connecti...

Offshore Outsourcing of Tech Services Can Be Problematic: A few weeks ago, HHS removed two Obamacare enrollment companies from accessing th...

Great Write-Up on OCR's 3rd Ransomware Settlement: Theresa Defino of Report on Patient Privacy has an excellent article on the recently...

Baim Institute for Clinical Research Suffers Ransomware event and Data Disclosure: According to this analysis by Safety Detectives , Baim ...

OneBlood Blood Donation Center Hit by Ransomware Attack: The blood donation and distribution organization, which supports 350 hospitals acro...

2024 Will Be Big:   I have a feeling 2024 will be a record year for data breaches, both in number of breaches overall and the size of the b...

  Change Healthcare Updates its Breach Notice. They added a timeline , apparently, and are going to finally start sending notices to affecte...

If you're using MOVEit, you should PATCHit first: Lots of folks in the healthcare industry use MOVEit for file transfers; about a year a...

Geisinger data breach impacted 1.2 million people: This breach is interesting because it's a disgruntled former employee of a vendor wh...

OCR settles ransomware and cybersecurity investigation involving Heritage Valley Health for $950,000: This is the 3rd settlement of a ranso...