The U.S. Department of Health & Human Services(HHS), Office for Civil Rights (OCR), has announced a Health Insurance Portability and Accountability Act of 1996 (HIPAA) settlement based on impermissible disclosure of protected health information (PHI). St. Luke’s-Roosevelt Hospital Center Inc. (St. Luke’s) has paid HHS $387,200 to settle potential violations of the HIPAA Privacy Rule…
Category: U.S.
Where is the future of HIPAA enforcement headed?
Ira Parghi of Ropes & Gray writes: Since January 2016, the OCR has entered into resolution agreements with, and imposed Corrective Action Plans (CAPs) on, providers and others in at least 12 matters involving the Security Rule. It has also imposed a Civil Monetary Penalty on one entity. Most of these cases involve stolen, unencrypted…
Hackers may have names of thousands of Florida gun owners
Andrew Ruiz reports: The Florida Department of Agriculture and Consumer Services is warning customers that hackers may have obtained the names of more than 16,000 people who have Florida concealed weapon permits. The data breach that appears to have originated from overseas affects people who entered information through the department’s online payment system. Read more…
School district reports breach due to caching problem with HomeLink
We don’t see breach notifications from k-12 districts that often, but here’s one submitted to the California Attorney General’s Office from the Mt. Diablo Unified School District: On April 27, 2017, when parents tried to access their student’s data through the HomeLink Portal, they were able to view information, as described below, of a student…
How ECMC got hacked by cyber extortionists
Henry L. Davis provides some greater depth to the coverage of the ransomware attack on Erie County Medical Center: It was 2 a.m. Palm Sunday. Computer screens across Erie County Medical Center flashed white with bright red words: “What happened to your files?” The ransom demands began with hot pink text. “Step1: You must send us…
Convicted Russian Cyber Criminal Roman Seleznev faces charges in Atlanta
May 19 – Roman Seleznev, of Vladivostok, Russia, has been arraigned on federal cyber fraud charges associated with the 2008 hack and theft of banking credentials from RBS Worldpay, a payment processing company located in Atlanta, Georgia. Seleznev was indicted by a federal grand jury on December 22, 2014. “In 2008, an American credit card processor…