1st Phishing-Related HIPAA Settlement Sends Other HIPAA Entities Phishing Warning |

1st Phishing-Related HIPAA Settlement Sends Other HIPAA Entities Phishing Warning

A resolution agreement with a Louisiana medical group announced December 7, 2023, that resolves the first charges arising from a phishing attack under the Health Insurance Portability and Accountability Act (“HIPAA”) warns other health care providers, health plans, health care clearinghouses (“Covered Entities”) and their business associates (collectively, “HIPAA Entities”) to ensure the adequacy of their risk analysis, safeguards, training and other processes for guarding electronic protected health information (“ePHI”) against phishing or other impermissible access.

According to the Department of Health and Human Services Office of Civil Rights (“OCR”) announcement of the landmark settlement, the charges against LaFourche Medical Group (“LaFourche”), a Louisiana medical group specializing in emergency medicine, occupational medicine, and laboratory testing, resulted from OCR’s investigation into a successful phishing attack on March 30, 2021 that allowed identity thieves to access an email account that contained ePHI of approximately 34,862 individuals.

HIPAA Entities Duty To Guard EPHI Against Phishing

The HIPAA Privacy Rule and Security Rule require health care providers, heath plans, health care clearinghouses (“Covered Entities”) and their businesses associates (collectively “HIPAA Entities”) to protect EPHI and other protected health information against use, access, disclosure or destruction by third parties except under the conditions allowed by HIPAA. These requirements include the requirements of the Security Rule to conduct and document comprehensive security assessments of risks to sensitive data systems, to implement and enforce detailed security safeguards to protect EPHI and the systems containing that data against these threats, to train and enforce compliance with these safeguards, and other requirements. Meanwhile, the HIPAA Breach Notification Rule requires Covered Entities to report most breaches of unsecured EPHI to individuals whose data is affected, OCR, and in the case of breaches of EPHI affecting more than 500 individuals, to the media.

Phishing is a type of cybersecurity attack used to trick individuals into disclosing sensitive information via electronic communication, such as email, by impersonating a trustworthy source. See OCR Quarter 1 2022 Cybersecurity Newsletter; OCR February 2018 Phishing Cybersecurity Newsletter.

OCR guidance confirms OCR views defending ePHI against phishing as a key part of compliance with these HIPAA requirements. See, e.g. OCR Quarter 1 2022 Cybersecurity Newsletter; Defending Against Common Cyber-Attacks; AI-Augmented Phishing and the Threat to the Health Sector; HHS 405d Health Industry Cybersecurity Practices on Email Phishing Attacks; Videos on “How the HIPAA Security Rule Can Help Defend Against Cyber-Attacks” in English and Spanish. OCR February 2018 Phishing Cybersecurity Newsletter.

OCR data confirms the number of breaches of unsecured ePHI reported to the OCR affecting 500 or more individuals (“large breaches”) due to hacking or IT incidents increased 45% from 2019 to 2020, and hacking or IT incidents accounted for 66% of all large breaches reported to OCR in 2020. U.S. Department of Health and Human Services Breach Portal. In keeping with this trend, large breaches affected more than 55 million individuals in 2022 and more than 89 million individuals in 2023. OCR reports phishing played a key role in many of these breaches and contributed to many other breaches currently under OCR investigation. See U.S. Department of Health and Human Services Breach Portal; OCR Quarter 1 2022 Cybersecurity Newsletter.

The widespread availability and use of artificial intelligence technology has only made phishing attempts more effective, especially since those tools are freely available to the public. AI-Augmented Phishing and the Threat to the Health Sector.

The 2021 HIMSS Healthcare Cybersecurity Survey reveals phishing is the most common attack impacting healthcare organizations, comprising almost half of all attacks. Data shows hackers frequently use phishing against the health sector because it often leads to data breaches that allow attackers to access large quantities of lucrative stolen health data. AI-Augmented Phishing and the Threat to the Health Sector.

LaFourche Phishing Breach

The OCR investigation of LaFourche arose from a May 28, 2021 data breach report LaFourche filed reporting a March 30, 2021 breach. According to the breach report, LAFOURCHE learned on March 30, 2021, that an unauthorized individual obtained access to one of its owners’ email accounts through a phishing attack. LAFOURCHE determined that the email account contained patients’ EPHI. According to the report, on March 30, 2021, LAFOURCHE learned that an unauthorized individual obtained access to one of its owners’ email accounts through a phishing attack. LAFOURCHE determined that the email account contained patients’ protected health information (PHI). As LAFOURCHE was unable to identify the specific patients affected, LAFOURCHE notified all of its patients – approximately 34,862 individuals of the incident. As LAFOURCHE was unable to identify the specific patients affected, LAFOURCHE notified all of its patients – approximately 34,862 individuals – of the incident.

OCR’s investigation opened in January, 2022 in response to the breach report revealed found that before LAFOURCHE made the breach report LAFOURCHE never conducted a Security Rule risk analysis and had no policies or procedures in place to regularly review information system activity to safeguard protected health information against cyberattacks.

To resolve OCR HIPAA charges arising from the breach, LaFourche agreed to pay $480,000 to OCR and to implement and follow a corrective action plan that includes the following requirements:

Establishing and implementing security measures to reduce security risks and vulnerabilities to electronic protect health information in order to keep patients’ protected health information secure;
Developing, maintaining, and revising written policies and procedures as necessary to comply with the HIPAA Rules; and
Providing training to all staff members with access to patients’ protected health information on HIPAA policies and procedures.

OCR will monitor for two years. LaFourche’s adherence with the compliance plan for two years.

While the $480,000 that LaFourche is a significant amount for a medical practice to pay, agreeing and adhering to the requirements of the settlement agreement and its incorporated corrective action plan allows LaFourche to avoids becoming subject to significantly greater civil monetary penalties authorized by HIPAA for breaches of its Privacy, Security and Breach Notification Rules. Under the terms of the resolution agreement, however, HHS can still pursue civil monetary penalties against LaFourche for the violations if OCR finds LaFourche failed to comply with any of the requirements of its corrective action plan or otherwise violates HIPAA.

LaFourche Experience Warns Other HIPAA Entities To Tighten Phishing Defenses

The LaFourche resolution agreement serves as a warning to other HIPAA entities. OCR’s announcement of the settlement quotes OCR Director Melanie Fontes Rainer as stating, “It is imperative that the health care industry be vigilant in protecting its systems and sensitive medical records, which includes regular training of staff and consistently monitoring and managing system risk to prevent these attacks. We all have a role to play in keeping our health care system safe and taking preventive steps against phishing attacks.”

Based on the LaFourche resolution agreement and other guidance, HIPAA entities should heed this warning by ensuring their organization is prepared to demonstrate to OCR in the event of an OCR audit or breach investigation by among other things, establishing appropriate governance with C-level oversight of compliance efforts; conducting documented periodic systemic risk assessments addressing phishing and other threats; actions taken to implement appropriate safeguards and monitor their effectiveness; appropriate workforce training and enforcement of policies and procedures; timely investigation and response to known or suspected breaches; timely breach reporting and mitigation; and other compliance with the Security Rule.

With regard to phishing, the Office of Information Security Whitepaper on AI-Augmented Phishing and the Threat to the Health Sector provides specific tips for successful prevention of phishing attacks including but not limited to:

Ensuring proper email server configuration or integrating a spam gateway or other appropriate additional platform into the information infrastructure, such as a spam gateway filter, to help filter unwanted e-mails;
Multi-factor authentication (MFA) requirements to protect against stolen credentials, which can be the initial purpose of a phishing attack;
Up-to-date malware and other security software to detect malware as it is being executed onto the system;
Conducting periodic end-user awareness training on detection of phishing e-mails and interacting with all e-mail with healthy skepticism including specific training on comment formats and tricks including those generated using AI tools;
Systematically using appropriately updated and robust processes for monitoring and detecting suspicious activities/indicators on an ongoing basis.

HIPAA entities also should keep in mind that phishing is only one of a multitude of compliance and enforcement risks highlighted by OCR’s recent enforcement and guidance. Along with reviewing and updating their phishing defenses, HIPAA entities also should review and update other processes as needed to manage these exposures.

Additionally, HIPAA entities and their leaders also should take steps to understand and fully address all other statutory, ethical, contractual or other privacy or confidentiality requirements beyond those imposed by HIPAA. For example, health care providers, health plans and their fiduciaries, brokers, administrators and insurers also may bear responsibilities under the Employee Retirement Income Security Act fiduciary responsibility rules, the Fair and Accurate Credit Transactions Act, federal and state electronic crimes and privacy laws. Publicly traded organizations and their leaders may face responsibilities and liability under new Securities and Exchange Commission regulations. The Employee Benefit Security Administration considers managing cybersecurity risks a part of the fiduciary obligations of fiduciaries of employment-based health plans. Meanwhile, health care providers, insurance organizations and brokers, third party administrators, government contractors, attorneys and other advisors and others also may be subject to medical confidentiality and other data privacy and security obligations under federal and state electronic crimes, identity theft, ethics, professional licensure, contractual, common law privacy and other statutory and common laws.

While it commonly is necessary or advisable to involve consulting or other technical support in the conduct of these activities, HIPAA entities should keep in mind the likelihood that their analysis and review is likely to uncover and prompt discussion of potentially legally or politically sensitive information. For this reason, HIPAA entities and their leaders generally will want to engage experienced legal counsel for assistance in structuring and executing these activities to maximize their ability to claim attorney-client privilege or other evidentiary protections against discovery or disclosure of certain aspects of these activities.

Finally, HIPAA entities should keep in mind that HIPAA and other cybersecurity compliance and risk management is an ongoing process requiring constant awareness and diligence. Consequently, HIPAA entities should both monitor OCR and other regulatory and enforcement developments as well as exercise ongoing vigilance to monitor and maintain compliance within their organizations.

For More Information

We hope this update is helpful. For more information about these or other health or other legal, management or public policy developments, please contact the author Cynthia Marcotte Stamer via e-mail or via telephone at (214) 452 -8297.

Solutions Law Press, Inc. invites you to receive future updates by registering on our Solutions Law Press, Inc. Website and participating and contributing to the discussions in our Solutions Law Press, Inc. LinkedIn SLP Health Care Risk Management & Operations Group, HR & Benefits Update Compliance Group, and/or Coalition for Responsible Health Care Policy.

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.

About the Author

Recognized by her peers as a Martindale-Hubble “AV-Preeminent” (Top 1%) and “Top Rated Lawyer” with special recognition LexisNexis® Martindale-Hubbell® as “LEGAL LEADER™ Texas Top Rated Lawyer” in Health Care Law and Labor and Employment Law; as among the “Best Lawyers In Dallas” for her work in the fields of “Labor & Employment,” “Tax: ERISA & Employee Benefits,” “Health Care” and “Business and Commercial Law” by D Magazine, Cynthia Marcotte Stamer is a practicing attorney board certified in labor and employment law by the Texas Board of Legal Specialization and management consultant, author, public policy advocate and lecturer widely known for 35 plus years of health industry and other management work, public policy leadership and advocacy, coaching, teachings, and publications.

A Fellow in the American College of Employee Benefit Counsel, Co-Chair of the American Bar Association (“ABA”) International Section Life Sciences and Health Committee and Vice-Chair Elect of its International Employment Law Committee, Chair-Elect of the ABA TIPS Section Medicine & Law Committee, Past Chair of the ABA Managed Care & Insurance Interest Group, Scribe for the ABA JCEB Annual Agency Meeting with HHS-OCR, past chair of the ABA RPTE Employee Benefits & Other Compensation Group and current co-Chair of its Welfare Benefit Committee, and Chair of the ABA Intellectual Property Section Law Practice Management Committee, Ms. Stamer is most widely recognized for her decades of pragmatic, leading-edge work, scholarship and thought leadership on healthcare and life science, managed care and insurance and other workforce and staffing, employee benefits, safety, contracting, quality assurance, compliance and risk management, and other legal, public policy and operational concerns in the healthcare and life sciences, employee benefits, managed care and insurance, technology and other related industries. She speaks and publishes extensively on these and other related compliance issues.

Ms. Stamer’s work throughout her career has focused heavily on working with health care and managed care, life sciences, health and other employee benefit plan, insurance and financial services and other public and private organizations and their technology, data, and other service providers and advisors domestically and internationally with legal and operational compliance and risk management, performance and workforce management, regulatory and public policy and other legal and operational concerns. Scribe for the ABA JCEB Annual Meeting with the HHS Office of Civil Rights, her experience includes extensive involvement throughout her career in advising health care and life sciences and other clients about preventing, investigating and defending EEOC, DOJ, OFCCP and other Civil Rights Act, Section 1557 and other HHS, HUD, banking, and other federal and state discrimination investigations, audits, lawsuits and other enforcement actions as well as advocacy before Congress and regulators regarding federal and state equal opportunity, equity and other laws.

For more information about Ms. Stamer or her health industry and other experience and involvements, see www.cynthiastamer.com or contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here.

About Solutions Law Press, Inc.™

Solutions Law Press, Inc.™ provides human resources and employee benefit and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education on leadership, governance, human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also be interested in reviewing some of our other Solutions Law Press, Inc.™ resources available here such as:

IMPORTANT NOTICE ABOUT THIS COMMUNICATION

NOTICE: These statements and materials are for general informational and educational purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation in light of the specific facts and circumstances presented in their unique circumstances at any particular time. No comment or statement in this publication is to be construed as legal advice or an admission. The author and Solutions Law Press, Inc.™ reserve the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law is rapidly evolving and rapidly evolving rules make it highly likely that subsequent developments could impact the currency and completeness of this discussion. The author and Solutions Law Press, Inc.™ disclaim, and have no responsibility to provide any update or otherwise notify anyone of any such change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication. Readers acknowledge and agree to the conditions of this Notice as a condition of their access to this publication.

Circular 230 Compliance. The following disclaimer is included to ensure that we comply with U.S. Treasury Department Regulations. Any statements contained herein are not intended or written by the writer to be used, and nothing contained herein can be used by you or any other person, for the purpose of (1) avoiding penalties that may be imposed under federal tax law, or (2) promoting, marketing or recommending to another party any tax-related transaction or matter addressed herein.

This entry was posted on Friday, December 8th, 2023 at 11:43 am and is filed under Health Care. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.