Matt Fisher of Carium writes: Data breaches grab headlines on a daily basis and arise from a number of different scenarios. However, one question that is not necessarily examined closely (at least in news articles), is whether encryption was in place and why the encryption did not prevent the breach. That rhetorical question does not…
Category: Health Data
What Does the Fifth Circuit’s Vacating of HHS HIPAA Fines Mean for Companies This Year?
Here is some more commentary on the Fifth Circuit opinion in MD Anderson v. HHS. Elfin Noce, Liisa Thomas & Susan Ingargiola of SheppardMullin write, in part: On the ruling regarding the disclosure of ePHI, the Fifth Circuit held that HHS had failed to establish that MD Anderson disclosed ePHI to someone outside of the covered entity. The…
The M.D. Anderson Case and the Future of HIPAA Enforcement
Privacy law scholar Daniel Solove writes: The U.S. Court of Appeals for the 5th Circuit just issued a blistering attack on HIPAA enforcement by the U.S. Department of Health and Human Services (HHS). In University of Texas M.D. Anderson Cancer v. Department of Health and Human Services (No. 19-60226, Jan. 14, 2001), the 5th Circuit struck down a fine…
The Blackbaud ransomware breach — impact on school clients
In July, 2020, cloud software firm Blackbaud announced that it had been the victim of a ransomware attack that began in February of 2020 and continued until Blackbaud was able to kick the attackers out of their system in May. In order to try to protect their clients from having personal and sensitive information on…
BE: Cyber attack on Sacred Heart Hospital Mol: no patients at risk, but administration back on paper
vrtNWS reports (translation): The Sacred Heart Hospital in Mol has been hit by a cyber attack. Criminals have managed to smuggle viruses into the hospital’s IT system, presumably via email. No data has been stolen, so the patients’ medical information has not been leaked, but the viruses have shut down many systems. Read more on vrtNWS….
CEO who lied to thousands of patients by telling them they had less than six months to live in order to enroll them in hospice sentenced to prison
There are bad breaches, and then there are the ones where words like “despicable,” “evil,” “immoral,” “disgusting,” and “reprehensible” just seem too weak to express how decent people might feel. This case out of Texas is one of those. Here is DOJ’s press release issued today: The CEO of a Texas-based group of hospice and…