In April 20218, DataBreaches reported a ransomware incident in February 2018 that had affected 81,550 patients of the Center for Orthopaedic Specialists (COS) – Providence Medical Institute (PMI) in California. The entity’s notification at the time indicated that patients’ names, dates of birth, details about medical records, and Social Security numbers had been involved in the breach and that services at its three facilities in West Hills, Simi Valley, and Westlake Village were reportedly affected.
At the time, PMI claimed that they were notified of the attack by their unnamed IT vendor and that, to the best of their knowledge, although some patient information had been encrypted as a result of the attack, no patient information had been removed from their system. The group or individual responsible for the ransomware attack was never publicly named. The IT vendor has now been named in HHS’s findings as Creative Solutions in Computers (CSnC).
HHS’s investigation into the incident never indicated any closing statement or findings — until now. HHS OCR announced it has settled charges against Providence Medical Institute concerning violations of the HIPAA Security Rule.
Its notice of proposed determination to PMI in March provides some details about how the attacker accessed the system three times in February and March of 2018. The first attack occurred after an employee fell for a phishing attack. After the first two attacks, PMI was able to restore patient data within days of the attacks from backup tapes. But HHS also reported other problems, including the absence of any business associate agreement between COS-PMI and the IT vendor. HHS also states that PMI’s post-incident assessment had found that at the time of the attacks:
COS utilized unsupported and obsolete operating systems to host its ePHI data; COS did not have a demilitarized zone (DMZ) network enabled or configured to separate its private network from the public internet and untrusted networks; COS’s firewall was not properly configured to monitor and track access or changes to its network; and COS had Remote Desktop Protocols (RDPs) enabled which allowed insecure remote access to COS workstations from external sources. The assessment also found that at the time of the attacks, COS workforce members were sharing generic credentials with administrator access to log into COS’s workstations, which allowed all users logging into COS’s workstations to have unrestricted administrator access. The evidence collected during OCR’s investigation indicates that the ePHI was accessible and viewable to the attackers because encryption was not deployed on COS’s servers or workstations prior to the attacks.
Here is HHS OCR’s press release about the monetary penalty:
October 3, 2024 – Today, the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR) announced a $240,000 civil monetary penalty against Providence Medical Institute in Southern California, concerning potential violations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Security Rule, following a ransomware attack breach report investigation by OCR. Ransomware and hacking are the primary cyber-threats in health care. There has been a 264% increase in large breaches reported to OCR involving ransomware attacks since 2018.
“Failures to fully implement all of the HIPAA Security Rule requirements leaves HIPAA covered entities and business associates vulnerable to cyberattacks at the expense of the privacy and security of patients’ health information,” said OCR Director Melanie Fontes Rainer. “The health care sector needs to get serious about cybersecurity and complying with HIPAA. OCR will continue to stand up for patient privacy and work to ensure the security of health information of every person. On behalf of OCR, I urge all health care entities to always stay alert and take every precaution and steps to keep their systems safe from cyberattacks.”
OCR enforces the HIPAA Privacy, Security, and Breach Notification Rules, which sets forth the requirements that covered entities (health plans, health care clearinghouses, and most health care providers), and business associates must follow to protect the privacy and security of protected health information. The HIPAA Security Rule establishes national standards to protect individuals’ electronic personal health information that is created, received, used, or maintained by a covered entity. It also requires appropriate administrative, physical and technical safeguards to ensure the confidentiality, integrity, and security of electronic protected health information. The Civil Money Penalty resolves OCR’s investigation concerning Providence Medical Institute’s compliance with the HIPAA Security Rule.
OCR initiated an investigation following the receipt of a breach report filed by Providence Medical Institute in April 2018, which reported that its systems were impacted by a series of ransomware attacks that affected the electronic protected health information (ePHI) of 85,000 individuals between February and March 2018. OCR’s investigation determined that servers containing ePHI were encrypted with ransomware three times. OCR found two potential violations of the HIPAA Security Rule, including failure to have a business associate agreement in place and failure to implement policies and procedures to allow only authorized persons or software programs access to ePHI.
In March 2024, OCR issued a Notice of Proposed Determination seeking to impose a civil money penalty. Providence Medical Institute waived its right to a hearing and did not contest OCR’s findings. Accordingly, OCR imposed a civil money penalty of $240,000.
The Notice of Proposed Determination may be found at: https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/pmi-npd/index.html
The Notice of Final Determination may be found at: https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/pmi-nfd/index.html
OCR recommends that health care providers, health plans, clearinghouses, and business associates that are covered by HIPAA take the following steps to mitigate or prevent cyber-threats:
- Review all vendor and contractor relationships to ensure business associate agreements are in place as appropriate and address breach/security incident obligations.
- Integrate risk analysis and risk management into business processes; conducted regularly and when new technologies and business operations are planned.
- Ensure audit controls are in place to record and examine information system activity.
- Implement regular review of information system activity.
- Utilize multi-factor authentication to ensure only authorized users are accessing ePHI.
- Encrypt ePHI to guard against unauthorized access to ePHI.
- Incorporate lessons learned from incidents into the overall security management process.
- Provide training specific to organization and job responsibilities and on regular basis; reinforce workforce members’ critical role in protecting privacy and security.
The HHS Breach Portal: Notice to the Secretary of HHS Breach of Unsecured Protected Health Information may be found at: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
OCR is committed to enforcing the HIPAA Rules that protect the privacy and security of peoples’ health information. Guidance about the Privacy Rule, Security Rule, and Breach Notification Rules can also be found on OCR’s website.
If you believe that your or another person’s health information privacy or civil rights have been violated, you can file a complaint with OCR at https://www.hhs.gov/ocr/complaints/index.html.
Follow HHS OCR on X (formerly Twitter) at @HHSOCR.
Source: HHS