Today, the U.S. Department of Health and Human Services , Office for Civil Rights , announced a settlement under the Health Insurance Portability and Accountability Act of 1996 with Green Ridge Behavioral Health, LLC, a Maryland-based practice that provides psychiatric evaluations, medication management, and psychotherapy.
Have in place an accurate and through analysis to determine the potential risks and vulnerabilities to electronic protected health information; Under the terms of the settlement, Green Ridge Behavioral Health agreed to pay $40,000 and implement a corrective action plan that will be monitored by OCR for three years. The plan identifies steps that Green Ridge Behavioral Health will take to resolve potential violations of the HIPAA Privacy and Security Rules and to protect electronic protected health information, including:
Reviewing, and as necessary, developing, or revising its written policies and procedures to comply with the HIPAA Rules;Conducting an audit of all third-party arrangements to ensure appropriate business associate agreements are in place, where applicable; andRansomware and hacking are the primary cyber-threats in health care. Over the past five years, there has been a 256% increase in large breaches reported to OCR involving hacking and a 264% increase in ransomware.
Integrating risk analysis and risk management into business processes; and ensuring that they are conducted regularly, especially when new technologies and business operations are planned.Implementing regular review of information system activity.