OCR Continues Ransomware and Risk Analysis Enforcement Initiatives

The settlement marks OCR’s 20th ransomware enforcement action and 14th enforcement action in its Risk Analysis Initiative. OCR continues to emphasize that HIPAA covered entities and their business associates should take steps to mitigate or prevent cyberthreats, including:

• Identify where ePHI exists in the organization, including how ePHI enters, flows through, and leaves the organization’s information systems.
• Periodically conduct, and update as needed, a risk analysis and develop and implement a risk management plan to address identified risks to the confidentiality, integrity, and availability of ePHI.
• Ensure audit controls are in place to record and examine information system activity.
• Implement regular review of information system activity.
• Utilize mechanisms to authenticate information to ensure that only authorized users are accessing ePHI.
• Encrypt ePHI in transit and at rest to guard against unauthorized access to ePHI when appropriate.
• Incorporate lessons learned from incidents into the organization’s overall security management process.
• Provide workforce members with regular HIPAA training that is specific to the organization and the workforce members’ respective job duties.