The Department of Health and Human Services is gearing up for its first-ever round of HIPAA compliance audits of business associates, and is also developing new guidance aimed at helping organizations deal with a surge in cyber threats.
Recent data breaches involving mental health and substance abuse information highlight some of the special challenges that organizations can face in protecting extra-sensitive patient records. In one incident, stolen patient data was reportedly posted on the dark web.
Chipmaker Intel will spin out its Intel Security unit - once again named McAfee - with a value that's markedly lower than what it paid. Meanwhile, long-gone founder John McAfee is suing for the right to launch a new security company bearing his name.
Hear ISMG editors untangle the various elements in the Shadow Brokers-Equation Group saga, evaluate a new anti-ransomware tool and reflect on the 10th anniversary of the PCI Security Standards Council in this edition of the ISMG Security Report.
A former Fla. hospital worker has been sentenced to federal prison in a case involving criminal HIPAA violations and tax fraud. Although the prosecution of HIPAA-related crimes are still rare, some experts say such cases could be on the rise.
The nation's HIPAA enforcement agency has dramatically ramped up its issuance of breach-related financial penalties. In the ninth enforcement action of 2016, it slapped University of Mississippi Medical Center with a $2.75 million fine after a breach investigation revealed big security woes.
The federal agency that enforces HIPAA has been very busy lately, taking numerous steps to reiterate the importance of safeguarding patient data and stressing the need to prepare a breach response plan. But the agency still needs to improve transparency on breaches involving business associates.
Oregon Health & Science University says it has been slapped with a $2.7 million fine after HHS investigated two data breaches that affected a total of about 7,000 individuals. It's the eighth HIPAA-related settlement announced by HHS so far this year.
Most ransomware attacks result in a breach of protected health information that must be reported under HIPAA, according to newly released federal guidance for healthcare entities and business associates. But is the guidance clear enough?
The federal tally of major health data breaches shows that to-date in 2016, there have been more reported hacker incidents than during the first half of 2015. However, so far this year, those hacks appear to be affecting fewer individuals.
Members of Congress have sent a letter to federal regulators saying that because ransomware attacks are "different" from other breaches in the healthcare sector, there's a need for new recommendations in upcoming government guidance.
While awaiting new guidance from the HHS Office for Civil Rights, healthcare organizations can take several steps to help determine whether a ransomware attack is a reportable breach under HIPAA, says compliance attorney Betsy Hodge.
ISMG editors, in a special report, examine the status of data breach notification laws in a number of regions, including the European Union, which this past week implemented the General Data Protection Regulation, although enforcement won't take place for two years.
The College of Healthcare Information Management Executives is calling on Congress to create financial incentives for healthcare providers to boost their cybersecurity. Leslie Krigstein of CHIME offers examples of potential incentives in this in-depth audio report.