The Office for Civil Rights (OCR) has announced its fourth cybersecurity investigation and settlement, noting a 264% increase in significant ransomware breaches since 2018. A recent settlement with a medium-sized healthcare provider involved a $250,000 payment and commitments to enhance the security of Protected Health Information (PHI). This investigation and settlement underscore the critical need
What U.S. Healthcare Providers Trying to Leverage AI Can Learn from Australia Privacy Regulator’s Investigation into I-MED Radiology Network
Leveraging AI in healthcare requires vast amounts of data, but navigating privacy and data security laws is crucial. A recent investigation into Australia’s I-MED Radiology Network highlights concerns about using medical data for AI. This case offers valuable insights for U.S. providers, especially regarding compliance with HIPAA and other regulations. Read more.
Nuanced Privacy Laws Means Healthcare Organizations Should Prioritize Protecting Personal Information
The healthcare industry is among the most highly regulated industries when it comes to privacy protections. In addition to the federal Health Insurance Portability and Accountability Act (HIPAA), healthcare providers also must comply with a growing number of state laws governing data privacy and security. Fully complying with this patchwork of privacy protections is a
New HIPAA Final Rule Imposes Added Protections for Reproductive Health Care Privacy
On April 22, 2024, the federal Department of Health and Human Services’ Office for Civil Rights (OCR) announced a final rule enhancing privacy protections relating to reproductive health care. Specifically, the final rule amends the Privacy Rule under the Health Insurance Portability and Accountability Act (HIPAA) to, among other things, establish new limits on the
ChatGPT and HIPAA, Caution is Needed, Even ChatGPT Says So!
Recently, things may have sped up a little in your doctor’s office. The notes for your recent visit may have been organized and filed a little more quickly. You might have received assistance sooner than expected with a physician letter to your carrier concerning a claim. You also may have received copies of those medical
OCR Reminds Healthcare Providers and Their Business Associates – You Need an Incident Response Plan!
October is National Cybersecurity Awareness month, and the HHS Office for Civil Rights (OCR) has provided a timely reminder for HIPAA covered entities and business associates to have a written incident response plan! To learn why another policy is needed, what an incident response plan needs to include, and the reporting obligations, read the
Small NJ Medical Practice Becomes 18th Target of OCR’s HIPAA Right of Access Enforcement Initiative
The Office for Civil Rights (OCR) has taken enforcement action against a small New Jersey plastic surgery practice for its failure to timely respond to a patient’s records access request. Putting in place relatively simple policies, carefully developing template forms, assigning responsibility, training, and documenting responses can go a long way toward substantially minimizing the
OCR HIPAA Guidance For Getting PHI of COVID-19 Exposed Individuals to First Responders
With first responders on the front lines of helping to fight the coronavirus, sharing information about potential exposure to COVID-19 is critical to protecting them and preventing further spread. In these situations, the information shared is most often “protected health information” (PHI) under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule.
Is your e-PHI Secure? ONC and OCR Update HIPAA Security Risk Assessment Tool
October 2018 marks the 15th annual National Cyber Security Awareness Month. In honor of this occasion, the Office of the National Coordinator for Health Information Technology (ONC) and the HHS Office for Civil Rights (OCR) have jointly launched an updated HIPAA Security Risk Assessment (SRA) Tool to help covered entities and business associates comply