Suze Shaffer, Author at Aris Medical Solutions

HIPAA Security Rule Updates: Postponed, But Not Canceled!

Suze Shaffer October 19, 2026October 20, 2026

Healthcare practices have more time to prepare, but HIPAA enforcement has not stopped.

The proposed HIPAA Security Rule updates remain on hold until July 2027, giving healthcare organizations additional time to strengthen their cybersecurity safeguards. This date is still tentative, but organizations should use this time wisely.

However, delays do not eliminate existing HIPAA requirements or reduce an organization’s responsibility to protect patient information.

The Department of Health and Human Services (HHS) continues to enforce the current HIPAA Security Rule.

Medical practices, dental offices, and business associates should use this additional time wisely.

Waiting for the final rule could leave your organization vulnerable to cyberattacks, data breaches, and costly enforcement actions.

What Is Changing Under the Proposed Security Rule?

HHS proposed significant changes to strengthen cybersecurity protections across the healthcare industry.

The proposed updates would remove the distinction between “required” and “addressable” implementation specifications and make all implementation specifications with specific security requirements and reduce flexibility in certain areas.

Although these changes are not final, they provide a clear picture of federal cybersecurity priorities.

1. Multifactor Authentication (MFA)

The proposal would require multifactor authentication for accessing systems containing electronic protected health information (ePHI), with limited exceptions. MFA adds another layer of protection when criminals steal or compromise passwords. Organizations should prioritize MFA for email, remote access, administrative accounts, and systems containing patient information.

2. Stronger Encryption Requirements

The proposal would generally require encryption of ePHI at rest and during transmission, subject to limited exceptions. Encryption helps protect sensitive information when criminals steal devices or intercept electronic communications. Organizations should review encryption settings across computers, servers, mobile devices, cloud platforms, and backup systems.

3. Technology Asset Inventories and Network Maps

The proposed updates would require organizations to maintain technology asset inventories and network maps and review and update at least every 12 months. These documents would identify systems, devices, applications, and connections involving ePHI. Accurate inventories help organizations identify vulnerabilities, unauthorized connections, and outdated technology. Network maps should also identify third-party connections and systems that process patient information, including AI.

4. More Comprehensive Security Risk Analyses

The current Security Rule already requires organizations to conduct an accurate and thorough security risk analysis. The proposal would establish more detailed requirements for identifying threats, vulnerabilities, and potential risks to ePHI. Organizations must also address identified risks through appropriate security measures. A completed questionnaire alone does not demonstrate that an organization has addressed its security vulnerabilities.

5. Enhanced Audit Controls and Monitoring

The proposed updates would strengthen requirements for monitoring electronic systems and reviewing activity involving ePHI. Organizations should maintain audit logs that help identify unauthorized access, suspicious activity, and potential security incidents. Regular reviews can reveal unusual behavior before a minor incident becomes a significant breach.

6. Vulnerability Scanning and Penetration Testing

The proposal would establish specific vulnerability scanning and penetration testing requirements. Vulnerability scanning helps identify weaknesses in software, devices, and network configurations. Penetration testing evaluates whether attackers could exploit security weaknesses. Organizations should already evaluate their exposure to cybersecurity threats and implement appropriate safeguards. Require regulated entities to conduct a compliance audit at least once every 12 months to ensure their compliance with the Security Rule requirements.

7. Stronger Backup and Disaster Recovery Protections

The proposed updates would strengthen contingency planning, backup verification, and recovery testing requirements. Healthcare organizations must prepare for ransomware attacks, system failures, natural disasters, and other emergencies. Regular testing helps confirm that organizations can restore critical information and continue essential operations. Establish written procedures to restore the loss of certain relevant electronic information systems and data within 72 hours.

8. Greater Oversight of Business Associates

Business associates already have direct HIPAA Security Rule responsibilities when handling ePHI. The proposal would add specific requirements involving written verification of technical safeguards. Covered entities should verify that vendors maintain appropriate security protections rather than relying solely on signed agreements. A qualified subject expert must review relevant electronic information systems to confirm that required safeguards protect ePHI. The business associate or subcontractor must provide written certification confirming the expert completed an accurate analysis. Business associates must provide this verification to covered entities, while subcontractors must provide it to their business associates. This includes IT providers, billing companies, cloud vendors, and other organizations accessing patient information. The proposed Security Rule would require business associates and their subcontractors to verify their technical safeguards at least annually.

The current HIPAA Security Rule remains enforceable, regardless of the proposed updates.

What Medical Practices and Business Associates Must Do Today

Organizations must continue implementing appropriate administrative, physical, and technical safeguards.

These responsibilities include:

Conducting accurate and thorough security risk analyses.
Implementing risk management measures to address identified vulnerabilities.
Maintaining current HIPAA policies and procedures.
Training employees on their security responsibilities.
Establishing appropriate access controls and audit controls.
Protecting workstations, devices, networks, and electronic patient information.
Maintaining security incident response and contingency plans.
Evaluating business associates and maintaining required agreements.
Reviewing security safeguards when systems, technology, or business operations change.

Organizations must document their compliance efforts and maintain evidence supporting their security decisions.

Why Waiting Could Cost Your Organization

Cybercriminals do not wait for federal regulations to become final. They continue targeting healthcare organizations through phishing, ransomware, compromised credentials, and vulnerable systems.

Smaller medical and dental practices are not immune to these threats. Business associates are also targeted to gain access to a medical practice.

A single security incident can interrupt patient care, expose sensitive information, and create significant financial consequences.

A postponed regulation does not mean postponed responsibility.

Organizations that prepare now can reduce risks while avoiding rushed compliance efforts when new requirements take effect.

**How the HIPAA Keeper™ Helps You Prepare**

At Aris Medical Solutions, we believe HIPAA compliance should be manageable, organized, and ongoing. Our HIPAA Keeper™ platform helps medical practices and business associates maintain essential compliance documentation.

The platform includes security risk analyses, risk management plans, policies, employee training, business associate agreements, and incident response documentation. Our program also helps organizations track compliance activities and prepare documentation for regulatory reviews.

As regulations evolve, we help clients understand new requirements and update their compliance programs.

HIPAA compliance is not a one-time project. It requires continuous attention, documentation, and improvement.

Don’t Wait for the Final Rule!

The proposed HIPAA Security Rule updates may be postponed, but the need for stronger cybersecurity protections remains.

Use this additional time to evaluate your safeguards, address vulnerabilities, and strengthen your compliance documentation.

When was the last time your organization updated its HIPAA security risk analysis?

Aris Medical Solutions can help you identify compliance gaps and prepare for upcoming changes.

Schedule your HIPAA compliance review today and protect your organization from the next enforcement headline.

Your Trusted Partner for HIPAA Compliance since 2009

Regulatory sources

For publication, these official references support the article:

HIPAA Checklist vs True Compliance

Suze Shaffer July 8, 2026July 8, 2026

Distinction That Matters:

Many practitioners view HIPAA as a compliance checklist. They sign forms, complete training, and check boxes. This mindset weakens compliance and patient protection. HIPAA reflects the privacy and security principles that support quality patient care. These principles matter whether the law requires them or not. HIPAA compliance goes beyond checking off a list. Strong compliance creates a culture of privacy, security, and accountability. Organizations should strengthen their security programs now. Do not wait for stricter Security Rule requirements to be finalized before taking action. Patients entrust you to protect their privacy.

Patient Protection:

Trust as a prerequisite. Patients who fear disclosure often withhold important health information. This includes mental health, substance use, sexual health, and HIV status. Incomplete information can lead to inaccurate diagnoses and treatment decisions. Strong privacy protections build trust and encourage honest communication. Better communication leads to better clinical outcomes.

Preventing downstream harm. Cybersecurity is now viewed as a patient safety issue, not just an IT responsibility. PHI exposure doesn’t merely embarrass, it causes measurable injury: loss of employment, insurance discrimination, damaged relationships, domestic violence risk (particularly relevant when an abuser shares a health plan), and in some cases physical danger. Healthcare providers protect patients by securing their information and handling it responsibly.

Continuity of the relationship. Unauthorized disclosures can permanently damage patient trust. Even well-intentioned disclosures can weaken the patient-provider relationship. Patients who lose trust often delay or avoid needed care. Strong privacy protections support lasting relationships and better patient outcomes.

Practice Protection:

Breach costs are severe and compounding. OCR penalties range from $145 to $73,011 per violation, with annual caps reaching over $2 million per violation category. More damaging is the breach notification requirements, mandatory corrective action plans, and reputational exposure that affects patient volume and referral networks. A single ransomware incident or misdirected fax can trigger all of these simultaneously.

Breach exposure expands with data failures. A breach that causes patient harm creates dual liability, regulatory and civil. HIPAA does not offer a patient right of action; however, plaintiffs’ attorneys increasingly treat PHI mishandling as evidence of systemic negligence, not merely a technical violation. It colors how a jury perceives the entire standard of care and imposes high settlements during a class action lawsuit.

Third-party relationships. Business Associate Agreements exist because your liability extends through your vendors. A practice that doesn’t rigorously manage BAAs inherits risk from EHR vendors, billing services, and cloud storage providers. Ignorance of a downstream breach is not a defense. Business associates are increasingly being held to the same security expectations as covered entities.

Ethical Compliance Frameworks Often Miss:

HIPAA did not create patient confidentiality. It established enforceable standards for an existing ethical duty. The Hippocratic Oath, AMA ethics, and medical ethics frameworks all recognize confidentiality as a core responsibility.

HIPAA transforms that responsibility into specific, measurable, and auditable requirements. Many organizations treat HIPAA compliance as the finish line instead of the starting point. This approach creates unnecessary compliance and ethical risks. The Minimum Necessary Standard reflects more than a legal requirement. It requires staff to access only the information needed for legitimate purposes. This standard supports both patient privacy and ethical decision-making.

Practices that embrace this principle build stronger compliance programs. They also earn greater patient trust than organizations that simply check compliance boxes.

The Practical Mixture:

A practice that treats HIPAA as necessary and not merely required will:

Build patient relationships capable of supporting honest clinical communication
Reduce liability exposure across both regulatory and civil channels
Establish vendor and staff accountability structures that prevent the most common breaches (insider access, phishing, improper disposal)
Operate with a defensible standard of care in the event of litigation

The law exists. But the reasons to comply existed before it, and they matter more.

For organizations following HIPAA closely, the message from regulators and industry experts is clear: maintaining a written, well-documented compliance program with strong cybersecurity controls is becoming the baseline expectation, not a best practice. One of the main enforcement requirements is that of a Risk analysis as a starting point. Then must be updated as technology and staff changes.

Protect Your Organization Before It’s Too Late

HIPAA compliance isn’t a one-time project; it’s an ongoing process. At Aris Medical Solutions, our HIPAA Keeper™ system simplifies compliance with a cloud-based platform that walks you through each requirement, step by step. From risk analysis to training and documentation, you’ll have everything you need to stay protected, compliant, and audit ready.

Protect your practice — and your patients.

Schedule a free HIPAA checkup today at Aris Medical Solutions. Your HIPAA Compliance Officer will have a HIPAA security analyst to guide and assist them every step of the way.

IT Administrative Rights and Requirements

Suze Shaffer August 15, 2025September 4, 2025

This case illustrates why a HIPAA Security Officer must have administrative rights access to their organization’s IT infrastructure. Although the compliance officer may not know what to do with this access, it is required so you have control over your network. Should the need arise to replace your IT administrator or IT vendor, you won’t be held hostage. Also, this demonstrates the necessity to check references and BEFORE you terminate someone, be sure their access has been removed.

In the incident below, a fired IT administrator used his elevated access to disable firewalls, delete company data, remove email security filters, and block the business from its own systems—crippling operations. If only a single IT employee holds full administrative control, the organization becomes vulnerable to sabotage, insider threats, and operational paralysis if that person is unavailable, leaves unexpectedly, or acts maliciously.

For HIPAA-regulated entities, losing access to security systems or audit logs can also prevent breach detection and reporting, creating compliance violations and potential fines. A HIPAA Security Officer with administrative rights ensures independent oversight, immediate access to critical systems, and the ability to secure PHI systems without relying solely on IT staff—safeguarding both security and compliance.

If you need assistance with IT services, we work with some of the best in the industry. Use the Contact Us page and we will send our recommendations.

5 Felony Charges for Palm Coast IT Administrator Accused of Launching Cyber Attack on His Company After He’s Fired

Taken from Flagler Live

A 41-year-old resident of Palm Coast was arrested on five felony charges following a Florida Department of Law Enforcement investigation that found him to have allegedly carried out a cyber-attack on his company’s computer infrastructure in retaliation for the company firing him. The attack crippled some of the company’s functions.

“Dude I think I got my company in a choke hold,” the father of two young children, is alleged to have written in a message to someone after the cyber-attack.

The Spice and Tea Exchange, an online and in-store retailer originally founded in St. Augustine and based in Palm Harbor, hired an IT System Administrator in mid-October 2024. (The FDLE refers to it as The Spice and Tea Company.) He was fired last Jan. 14. “Within minutes, the company’s firewall, E-mail, and physical security was infiltrated,” FDLE’s warrant states, resulting “in completed deletion of company data.”

A human resources executive at the company told the FDLE investigator that while his position was being eliminated, he had “displayed very concerning behaviors while employed,” such as having a short fuse. The day of the firing he was working from home. The HR executive called him at noon to let him know he was fired. The conversation lasted just under 10 minutes.

According to the warrant, he “made several threatening statements prior to terminating the call. For one, [he] had stated ‘your company is not prepared for what is coming your way.’”

Almost as soon as he was fired the company would have disconnected him from its firewall and restricted access. That was to be done while the HR executive was still on the phone with him. But in what appeared to have been a movie-like race between IT employees, he was a step ahead of his ex-IT colleague at the Spice and Tea Exchange. He’d logged into the system at the same time that his colleague was racing to restrict access. He “overtook” him and the entirety of the business’ email access. The company “immediately lost access to the company firewall and emails,” the warrant states. He removed the firewall and obstructed business “continuity.”

He’d left one of his company laptops at the office. His colleague opened it–there was no expectation of privacy with a company laptop–and noticed that had his logon to his Chrome and Gmail accounts was automatic, and that it was syncing his other devices with his work computer, a violation of company policy. Within an hour or so of his firing, his history showed he had searched for “Florida Unemployment” and “Palm Coast Lawyers.”

The colleague also discovered that an email filtering service blocking spam and malware had been removed, requiring 3,800 emails to be manually approved. The company was no longer able to log into its own firewall and eventually learned from the Sisco Meraki Company, which provided the firewall data for the Exchange, that the company was deleted from Meraki’s database. So, there were no logs of the attack he allegedly orchestrated.

FDLE confirmed that the last user to make changes to the account had a username of his first initial and last name. FDLE also subpoenaed information from Google and was informed by Charter Communications of further data that led to his house in Palm Coast. Circuit Judge Chris France signed a search warrant, which was served on April 25.

He acknowledged his role when he was IT administrator but denied accessing the firewall.

France signed the FDLE warrant for his arrest on July 7. On Wednesday, he was driving his vehicle on State Road 11 in Flagler County when he was pulled over by a Flagler County Sheriff’s deputy, arrested, and taken to jail, where he was booked and soon released on $25,000 bond.

He faces three charges of computer fraud, a charge of tampering with computer intellectual property and a charge of unlawful use of a two-way communication device. Four of the charges are third-degree felonies, each with a maximum penalty of five years in prison. One of the charges is a second-degree felony, with a 15-year maximum if convicted.

New I-9 Requirements

Suze Shaffer August 1, 2025August 15, 2025

Although this is not a HIPAA requirement, it does affect every business.

Here are the highlights:

Updated Form I‑9

Business should use the new form dated January 20, 2025, with an expiration date of May 31, 2027, if you are not doing so already.
Prior editions from August 1, 2023 will remain valid until their respective expiration dates—either May 31, 2027 or July 31, 2026.
Employers using electronic I‑9 systems must update to reflect the form version with the May 31, 2027 expiration by July 31, 2026.

Key Form Changes

Section 1 terminology

The fourth citizenship attestation box now reads “An alien authorized to work”, replacing the former phrase “A noncitizen authorized to work.”

List B document descriptions

Minor updates include replacing the term “gender” with “sex” in two acceptable documents (e.g. driver’s license), for improved clarity.

Instructions and DHS Privacy Notice

Newly added statutory language and updated Department of Homeland Security Privacy Notice appear in the guidance section of the new form.

E-Verify & E‑Verify+ Updates (Effective April 3, 2025)

The citizenship status selection in E‑Verify and E‑Verify+ now displays “An alien authorized to work” for consistency. Even if the legacy form still shows “A noncitizen authorized to work.”
For E‑Verify Web Services submissions, back‑end systems automatically convert the older phrasing to the updated version. Developers should ensure platforms transmit “An alien authorized to work” to maintain compliance.

Employer Responsibilities & Compliance Tips

Adopt the 01/20/2025 edition as soon as possible—especially for newly hired employees.
Continue using valid older editions until their expiration, but update your electronic systems by July 31, 2026 to the correct version expiration date.
Train HR and hiring staff on the updated language, document descriptions, and instruction changes.
Ensure E-Verify users select “An alien authorized to work” regardless of what appears on older I‑9 forms during data entry.

Summary

The new I-9 form adoption deadline for electronic systems is July 2026, but manual use of the updated form is recommended immediately.
Terminology and document description are minor—but important for alignment with federal law.
HR and compliance teams should confirm systems, forms, and procedures are updated to avoid inconsistencies or audit risks.

The new form and instructions can be found here: https://www.uscis.gov/i-9

DOJ Reveals Largest Coordinated Healthcare Fraud Effort in Agency History

Suze Shaffer July 1, 2025July 9, 2025

The U.S. Department of Justice (DOJ) has announced its largest-ever coordinated healthcare fraud takedown, charging 324 individuals, including 96 doctors, nurses, and other licensed medical professionals, across the country. The alleged schemes involved nearly $14.6 billion in fraudulent claims to federal healthcare programs such as Medicare and Medicaid, with actual estimated losses of around $2.9 billion.

There are approximately 66,000,000 Medicare beneficiaries, and 80 million on Medicaid or Children’s Health Insurance Program (CHIP). There are another 20 million people on the exchanges that could be affected by this fraud.

The DOJ, working alongside the Department of Health and Human Services (HHS) and other federal agencies, successfully blocked most of these fraudulent payments, preventing billions in losses. Authorities also seized over $245 million in cash, luxury items, and other assets connected to the schemes. The DOJ stated, “We’ve moved from ‘pay-and-chase’ to ‘stop-and-catch’—CMS and HHS‑OIG teams swiftly identified fraud, suspended payments, and seized tens of millions.”

A major portion of the fraud — known as Operation Gold Rush — centered on a transnational network involving Eastern European and Russian groups. These criminals allegedly used stolen identities of over 1 million Americans and acquired more than 30 U.S.-based medical supply companies to submit massive false claims for items such as urinary catheters and glucose monitors. In total, these companies alone tried to bill Medicare for more than 1 billion unnecessary devices.

This sweeping operation highlights both the scale of organized healthcare fraud and the government’s commitment to protecting taxpayer funds and patient identities. Officials emphasized ongoing efforts to strengthen oversight, including using advanced data analytics and AI tools to detect and stop fraud more effectively in the future.

Christopher Delgado is the acting deputy assistant director for the FBI’s Criminal Investigative Division that handles healthcare fraud. Here is an excerpt from the announcement that was made. “Possible health care fraud is not a victimless crime. Every dollar stolen from deceitful billing or unnecessary procedures is a dollar taken away from patients who truly need care and taxpayers who fund these critical programs”.

“Schemes like what was mentioned above drive medical costs up and strain federal healthcare budgets and ultimately impact every American who relies on Medicare, Medicaid, and other public and private insurance programs”.

“It’s also not just about financial losses. It’s about Patients being exposed to unnecessary procedures, false diagnosis and delayed care. That kind of exploitation isn’t just unethical, it’s dangerous and has no place in our healthcare system. Services that are wasteful and should not be offered to the American people because they could hurt them”.

Centers for Medicare and Medicaid Services (CMS) just launched a new model called WISeR (Wasteful and Inappropriate Service Reduction). The WISeR Model will help protect American taxpayers by leveraging enhanced technologies, such as Artificial Intelligence (AI) and Machine Learning (ML), along with human clinical review, to ensure timely and appropriate Medicare payment for select items and services. The voluntary model will encourage care navigation, encouraging safe and evidence-supported best practices for treating people with Medicare. WISeR will run for six performance years from January 1, 2026 to December 31, 2031. The application period opened on June 27, 2025.

They are asking that anyone that suspects waste, fraud, or abuse of our healthcare system to report this by calling 1-800 HHS TIPS or go to their website:

https://oig.hhs.gov/fraud

The content provided reflects the most up-to-date information available at the time of writing and should not be considered legal advice.

If you need assistance with HIPAA Compliance, check out our HIPAA Keeper™. Our online compliance system has everything you need to get compliant and stay compliant. Your HIPAA Compliance Officer will have a HIPAA security analyst to guide and assist them every step of the way!

For more information or to speak to someone about HIPAA Compliance call us at 877.659.2467 or use the contact us form.

What You Should Do After National Watchdog Warns of Data Breach Affecting 184 Million Passwords

Suze Shaffer June 3, 2025June 3, 2025

A leading national consumer watchdog group has sounded the alarm on a massive data breach, warning that as many as 184 million passwords may have been compromised. If confirmed, this breach would be one of the largest in recent history, potentially exposing sensitive login credentials and personal data for millions of users. Whether your data was directly affected or not, now is the time to take swift and smart action.

What We Know About the Breach

While details are still emerging, the watchdog group has reported that the breach involves leaked password databases that may have been collected through previous hacks, phishing schemes, or compromised third-party services. The data has reportedly surfaced on dark web forums and hacking communities, increasing the risk of identity theft, credential stuffing attacks, and financial fraud.

What You Should Do Immediately

1. Change Your Passwords—Starting with the Most Sensitive Accounts

Focus first on accounts that hold financial or sensitive information:

Bank accounts
Email accounts
Healthcare portals
Social media accounts linked to other logins

Use a strong, unique password for each account. Avoid reusing passwords across multiple sites.

2. Enable Multi-Factor Authentication (MFA)

MFA adds a second layer of security by requiring you to enter a verification code from your phone or authentication app. This can stop attackers even if they have your password.

3. Use a Password Manager

A password manager can help generate and securely store unique, complex passwords for all your accounts. This helps eliminate the temptation to reuse passwords and improves overall security.

4. Check If Your Passwords Were Compromised

Use a reputable service like:

HaveIBeenPwned.com
Your password manager’s breach monitoring tool
These tools can alert you if your email or credentials have been found in leaked data.

5. Monitor Your Accounts for Suspicious Activity

Regularly review your bank statements, credit card transactions, and email account access logs. If anything seems unusual, contact the relevant provider immediately.

6. Beware of Phishing Emails

After a major breach, phishing attempts tend to rise. Be cautious with emails that ask you to “verify your account,” click on suspicious links, or download unexpected attachments.

What Businesses Should Do

Implement mandatory password resets.
Audit your security protocols and consider third-party penetration testing.
Educate your employees on how to spot phishing and secure their accounts.

Final Thoughts

Cybersecurity experts have long warned that massive credential breaches are not a matter of if, but when. With the watchdog group raising this new alert, every consumer and organization should treat this as a wake-up call. The good news is that with the right precautions, you can minimize the damage and protect your digital life going forward.

Stay alert. Stay secure. And take action now—before someone else takes control of your data.

If you need assistance with HIPAA Compliance, check out our HIPAA Keeper™. Our online compliance system has everything you need to get compliant and stay compliant. Your HIPAA Compliance Officer will have a HIPAA security analyst to guide and assist them every step of the way!

For more information or to speak to someone about HIPAA Compliance call us at 877.659.2467 or use the contact us form.

Understanding HIPAA Resolution Agreements and Compliance Obligations

Suze Shaffer May 2, 2025June 3, 2025

A Resolution Agreement is a formal settlement between the U.S. Department of Health and Human Services (HHS) and a HIPAA-covered entity or business associate. Under the agreement, the organization agrees to take specific corrective actions and submit regular compliance reports to HHS, typically over a three-year period. During this time, HHS monitors the organization’s adherence to these requirements.

If a covered entity fails to demonstrate compliance or complete corrective actions satisfactorily—whether through informal resolution or a resolution agreement—civil money penalties (CMPs), commonly referred to as HIPAA fines, may be imposed.

Common Requirements in a Resolution Agreement

Some typical obligations in a resolution agreement include:

Payment: The covered entity must pay the agreed-upon settlement amount within 30 days of the agreement’s effective date.
Policy Review: Within 30 days, the entity must review and, if needed, revise its policies related to patient access to protected health information (PHI), including methods for calculating fees.
Training: Within 60 days, training materials must be developed and provided to staff on patients’ rights to access their PHI.
Access Log Reporting: Every 90 days, starting within 90 days of HHS approval of policies, the entity must submit a log of PHI access requests, including key details such as dates, formats, and costs.
Implementation Report: Within 120 days of HHS’s approval of the policies, a written implementation status report must be submitted.
Annual Reporting: Each year of the compliance term (e.g., three years) is considered a “Reporting Period.” The entity must submit an annual report to HHS within 60 days of the end of each period.

Additional Enforcement Authorities

In addition to HHS and the Office for Civil Rights (OCR), other agencies may impose penalties:

State Attorneys General: For example, Florida’s Consumer Protection Division enforces the Florida Deceptive and Unfair Trade Practices Act and has recovered over $10 billion since 2011.
Federal Agencies: The Department of Justice (DOJ), Office of Inspector General (OIG), and Federal Trade Commission (FTC) can also pursue penalties for fraud, privacy violations, or deceptive practices.

Helpful Links:

Corrective Action Plans (CAPs)

Most resolution agreements include a Corrective Action Plan (CAP) monitored by OCR, typically for two years. CAPs require the entity to take defined steps to address HIPAA compliance deficiencies, including:

Conducting a comprehensive risk analysis of potential threats to ePHI.
Implementing a risk management plan based on identified vulnerabilities.
Updating and maintaining written HIPAA policies and procedures.
Providing tailored HIPAA training to workforce members.

OCR Recommendations for Preventing Cyber Threats

To reduce cybersecurity risks, OCR recommends that HIPAA-covered entities and business associates:

Identify how ePHI flows through their systems.
Integrate risk analysis and management into daily operations.
Implement and review audit controls regularly.
Use authentication mechanisms to ensure only authorized access to PHI.
Encrypt ePHI in transit and at rest when appropriate.
Learn from past security incidents to strengthen future protections.
Provide HIPAA training for all staff.

By proactively implementing these measures, organizations can better protect patient data and avoid costly penalties, enforcement actions, and reputational damage.

For more information or to speak to someone about HIPAA Compliance call us at 877.659.2467 or use the contact us form.

HIPAA Settlement of $25K with New York Neurology Practice Over Ransomware Attack

Suze Shaffer April 25, 2025June 3, 2025

The U.S. Department of Health and Human Services Office for Civil Rights (OCR) has reached a settlement with Comprehensive Neurology, a small neurology practice based in New York, following a potential violation of the HIPAA Security Rule. The investigation stemmed from a ransomware attack that compromised the electronic protected health information (ePHI) of patients.

OCR’s investigation revealed potential failures by the practice to implement adequate security measures required under the HIPAA Security Rule, such as conducting a thorough risk analysis and maintaining appropriate safeguards to protect ePHI. The breach impacted sensitive health data and underscored vulnerabilities in the practice’s cybersecurity defenses.

Ransomware and hacking remain the leading cyber threats to electronic health information in the healthcare sector. Ransomware, a form of malicious software (malware), is designed to block access to a user’s data—typically by encrypting it—until a ransom is paid. This settlement represents the 12th enforcement action related to ransomware and the 8th action under OCR’s ongoing Risk Analysis Initiative.

As part of the settlement, Comprehensive Neurology agreed to pay a monetary fine of $25K and implement a corrective action plan that will be monitored for two years to strengthen its HIPAA compliance program, including risk assessments, updated security policies, and staff training.

This case highlights the importance of proactive cybersecurity measures for all healthcare providers, regardless of size, and reinforces OCR’s commitment to protecting patient data in the face of increasing cyber threats like ransomware.

For more information or to speak to someone about HIPAA Compliance call us at 877.659.2467 or use the contact us form.