Suze Shaffer, Author at Aris Medical Solutions

DOJ Reveals Largest Coordinated Healthcare Fraud Effort in Agency History

Suze Shaffer July 1, 2025July 9, 2025

The U.S. Department of Justice (DOJ) has announced its largest-ever coordinated healthcare fraud takedown, charging 324 individuals, including 96 doctors, nurses, and other licensed medical professionals, across the country. The alleged schemes involved nearly $14.6 billion in fraudulent claims to federal healthcare programs such as Medicare and Medicaid, with actual estimated losses of around $2.9 billion.

There are approximately 66,000,000 Medicare beneficiaries, and 80 million on Medicaid or Children’s Health Insurance Program (CHIP). There are another 20 million people on the exchanges that could be affected by this fraud.

The DOJ, working alongside the Department of Health and Human Services (HHS) and other federal agencies, successfully blocked most of these fraudulent payments, preventing billions in losses. Authorities also seized over $245 million in cash, luxury items, and other assets connected to the schemes. The DOJ stated, “We’ve moved from ‘pay-and-chase’ to ‘stop-and-catch’—CMS and HHS‑OIG teams swiftly identified fraud, suspended payments, and seized tens of millions.”

A major portion of the fraud — known as Operation Gold Rush — centered on a transnational network involving Eastern European and Russian groups. These criminals allegedly used stolen identities of over 1 million Americans and acquired more than 30 U.S.-based medical supply companies to submit massive false claims for items such as urinary catheters and glucose monitors. In total, these companies alone tried to bill Medicare for more than 1 billion unnecessary devices.

This sweeping operation highlights both the scale of organized healthcare fraud and the government’s commitment to protecting taxpayer funds and patient identities. Officials emphasized ongoing efforts to strengthen oversight, including using advanced data analytics and AI tools to detect and stop fraud more effectively in the future.

Christopher Delgado is the acting deputy assistant director for the FBI’s Criminal Investigative Division that handles healthcare fraud. Here is an excerpt from the announcement that was made. “Possible health care fraud is not a victimless crime. Every dollar stolen from deceitful billing or unnecessary procedures is a dollar taken away from patients who truly need care and taxpayers who fund these critical programs”.

“Schemes like what was mentioned above drive medical costs up and strain federal healthcare budgets and ultimately impact every American who relies on Medicare, Medicaid, and other public and private insurance programs”.

“It’s also not just about financial losses. It’s about Patients being exposed to unnecessary procedures, false diagnosis and delayed care. That kind of exploitation isn’t just unethical, it’s dangerous and has no place in our healthcare system. Services that are wasteful and should not be offered to the American people because they could hurt them”.

Centers for Medicare and Medicaid Services (CMS) just launched a new model called WISeR (Wasteful and Inappropriate Service Reduction). The WISeR Model will help protect American taxpayers by leveraging enhanced technologies, such as Artificial Intelligence (AI) and Machine Learning (ML), along with human clinical review, to ensure timely and appropriate Medicare payment for select items and services. The voluntary model will encourage care navigation, encouraging safe and evidence-supported best practices for treating people with Medicare. WISeR will run for six performance years from January 1, 2026 to December 31, 2031. The application period opened on June 27, 2025.

They are asking that anyone that suspects waste, fraud, or abuse of our healthcare system to report this by calling 1-800 HHS TIPS or go to their website:

https://oig.hhs.gov/fraud

The content provided reflects the most up-to-date information available at the time of writing and should not be considered legal advice.

If you need assistance with HIPAA Compliance, check out our HIPAA Keeper™. Our online compliance system has everything you need to get compliant and stay compliant. Your HIPAA Compliance Officer will have a HIPAA security analyst to guide and assist them every step of the way!

For more information or to speak to someone about HIPAA Compliance call us at 877.659.2467 or use the contact us form.

What You Should Do After National Watchdog Warns of Data Breach Affecting 184 Million Passwords

Suze Shaffer June 3, 2025June 3, 2025

A leading national consumer watchdog group has sounded the alarm on a massive data breach, warning that as many as 184 million passwords may have been compromised. If confirmed, this breach would be one of the largest in recent history, potentially exposing sensitive login credentials and personal data for millions of users. Whether your data was directly affected or not, now is the time to take swift and smart action.

What We Know About the Breach

While details are still emerging, the watchdog group has reported that the breach involves leaked password databases that may have been collected through previous hacks, phishing schemes, or compromised third-party services. The data has reportedly surfaced on dark web forums and hacking communities, increasing the risk of identity theft, credential stuffing attacks, and financial fraud.

What You Should Do Immediately

1. Change Your Passwords—Starting with the Most Sensitive Accounts

Focus first on accounts that hold financial or sensitive information:

Bank accounts
Email accounts
Healthcare portals
Social media accounts linked to other logins

Use a strong, unique password for each account. Avoid reusing passwords across multiple sites.

2. Enable Multi-Factor Authentication (MFA)

MFA adds a second layer of security by requiring you to enter a verification code from your phone or authentication app. This can stop attackers even if they have your password.

3. Use a Password Manager

A password manager can help generate and securely store unique, complex passwords for all your accounts. This helps eliminate the temptation to reuse passwords and improves overall security.

4. Check If Your Passwords Were Compromised

Use a reputable service like:

HaveIBeenPwned.com
Your password manager’s breach monitoring tool
These tools can alert you if your email or credentials have been found in leaked data.

5. Monitor Your Accounts for Suspicious Activity

Regularly review your bank statements, credit card transactions, and email account access logs. If anything seems unusual, contact the relevant provider immediately.

6. Beware of Phishing Emails

After a major breach, phishing attempts tend to rise. Be cautious with emails that ask you to “verify your account,” click on suspicious links, or download unexpected attachments.

What Businesses Should Do

Implement mandatory password resets.
Audit your security protocols and consider third-party penetration testing.
Educate your employees on how to spot phishing and secure their accounts.

Final Thoughts

Cybersecurity experts have long warned that massive credential breaches are not a matter of if, but when. With the watchdog group raising this new alert, every consumer and organization should treat this as a wake-up call. The good news is that with the right precautions, you can minimize the damage and protect your digital life going forward.

Stay alert. Stay secure. And take action now—before someone else takes control of your data.

If you need assistance with HIPAA Compliance, check out our HIPAA Keeper™. Our online compliance system has everything you need to get compliant and stay compliant. Your HIPAA Compliance Officer will have a HIPAA security analyst to guide and assist them every step of the way!

For more information or to speak to someone about HIPAA Compliance call us at 877.659.2467 or use the contact us form.

Understanding HIPAA Resolution Agreements and Compliance Obligations

Suze Shaffer May 2, 2025June 3, 2025

A Resolution Agreement is a formal settlement between the U.S. Department of Health and Human Services (HHS) and a HIPAA-covered entity or business associate. Under the agreement, the organization agrees to take specific corrective actions and submit regular compliance reports to HHS, typically over a three-year period. During this time, HHS monitors the organization’s adherence to these requirements.

If a covered entity fails to demonstrate compliance or complete corrective actions satisfactorily—whether through informal resolution or a resolution agreement—civil money penalties (CMPs), commonly referred to as HIPAA fines, may be imposed.

Common Requirements in a Resolution Agreement

Some typical obligations in a resolution agreement include:

Payment: The covered entity must pay the agreed-upon settlement amount within 30 days of the agreement’s effective date.
Policy Review: Within 30 days, the entity must review and, if needed, revise its policies related to patient access to protected health information (PHI), including methods for calculating fees.
Training: Within 60 days, training materials must be developed and provided to staff on patients’ rights to access their PHI.
Access Log Reporting: Every 90 days, starting within 90 days of HHS approval of policies, the entity must submit a log of PHI access requests, including key details such as dates, formats, and costs.
Implementation Report: Within 120 days of HHS’s approval of the policies, a written implementation status report must be submitted.
Annual Reporting: Each year of the compliance term (e.g., three years) is considered a “Reporting Period.” The entity must submit an annual report to HHS within 60 days of the end of each period.

Additional Enforcement Authorities

In addition to HHS and the Office for Civil Rights (OCR), other agencies may impose penalties:

State Attorneys General: For example, Florida’s Consumer Protection Division enforces the Florida Deceptive and Unfair Trade Practices Act and has recovered over $10 billion since 2011.
Federal Agencies: The Department of Justice (DOJ), Office of Inspector General (OIG), and Federal Trade Commission (FTC) can also pursue penalties for fraud, privacy violations, or deceptive practices.

Helpful Links:

Corrective Action Plans (CAPs)

Most resolution agreements include a Corrective Action Plan (CAP) monitored by OCR, typically for two years. CAPs require the entity to take defined steps to address HIPAA compliance deficiencies, including:

Conducting a comprehensive risk analysis of potential threats to ePHI.
Implementing a risk management plan based on identified vulnerabilities.
Updating and maintaining written HIPAA policies and procedures.
Providing tailored HIPAA training to workforce members.

OCR Recommendations for Preventing Cyber Threats

To reduce cybersecurity risks, OCR recommends that HIPAA-covered entities and business associates:

Identify how ePHI flows through their systems.
Integrate risk analysis and management into daily operations.
Implement and review audit controls regularly.
Use authentication mechanisms to ensure only authorized access to PHI.
Encrypt ePHI in transit and at rest when appropriate.
Learn from past security incidents to strengthen future protections.
Provide HIPAA training for all staff.

By proactively implementing these measures, organizations can better protect patient data and avoid costly penalties, enforcement actions, and reputational damage.

For more information or to speak to someone about HIPAA Compliance call us at 877.659.2467 or use the contact us form.

HIPAA Settlement of $25K with New York Neurology Practice Over Ransomware Attack

Suze Shaffer April 25, 2025June 3, 2025

The U.S. Department of Health and Human Services Office for Civil Rights (OCR) has reached a settlement with Comprehensive Neurology, a small neurology practice based in New York, following a potential violation of the HIPAA Security Rule. The investigation stemmed from a ransomware attack that compromised the electronic protected health information (ePHI) of patients.

OCR’s investigation revealed potential failures by the practice to implement adequate security measures required under the HIPAA Security Rule, such as conducting a thorough risk analysis and maintaining appropriate safeguards to protect ePHI. The breach impacted sensitive health data and underscored vulnerabilities in the practice’s cybersecurity defenses.

Ransomware and hacking remain the leading cyber threats to electronic health information in the healthcare sector. Ransomware, a form of malicious software (malware), is designed to block access to a user’s data—typically by encrypting it—until a ransom is paid. This settlement represents the 12th enforcement action related to ransomware and the 8th action under OCR’s ongoing Risk Analysis Initiative.

As part of the settlement, Comprehensive Neurology agreed to pay a monetary fine of $25K and implement a corrective action plan that will be monitored for two years to strengthen its HIPAA compliance program, including risk assessments, updated security policies, and staff training.

This case highlights the importance of proactive cybersecurity measures for all healthcare providers, regardless of size, and reinforces OCR’s commitment to protecting patient data in the face of increasing cyber threats like ransomware.

For more information or to speak to someone about HIPAA Compliance call us at 877.659.2467 or use the contact us form.