Green Ridge Behavioral Health Ransomware Attack and Empress Ambulance Service Lawsuit Settlement

by | Mar 2, 2024

Ransomware Attack on Green Ridge Behavioral Health Results in HIPAA Penalty

The Department of Health and Human Services (HHS) Office for Civil Rights (OCR) settled an alleged Health Insurance Portability and Accountability Act (HIPAA) violations with a behavioral healthcare provider in Maryland for $40,000. Green Ridge Behavioral Health, LLC (GRBH) based in Gaithersburg, MD provides psychiatric evaluations, medication management, and psychotherapy. In February 2019, GRBH submitted a report to OCR regarding the exposure of the protected health information (PHI) of 14,000 patients. A malicious actor accessed its systems and used ransomware for file encryption. The investigation revealed that the threat actor stole records containing sensitive patient data.

In December 2019, OCR started an investigation to confirm whether GRBH had observed the HIPAA Guidelines. GRBH did not provide OCR any proof that shows it

  • conducted an appropriate risk analysis to identify risks and vulnerabilities to electronic protected health information (ePHI), as mandated by 45 C.F.R. § 164.308(a)(l)(ii)(A)
  • implemented enough security procedures to minimize risks and vulnerabilities to ePHI to a reasonable and proper level, as called for by 45 C.F.R. § 164.308(a)(I)(ii)(B).

HIPAA-regulated entities must employ policies and procedures for reviewing logs of activity in information systems, for example, audit logs, access reports, and security incident tracking reports. However, guidelines and procedures were not enforced, as demanded by 45 C.F.R. § 164.308(a)(l)(ii) (A). These compliance problems caused an impermissible patients’ ePHI disclosure (45 C.F.R. § 164.502(a)).

Besides the financial penalty, GRBH must carry out a corrective action plan to deal with all areas of non-compliance found in the course of the investigation and OCR will keep track of GRBH for adopting the 3-year corrective action plan. The corrective action plan consists of the need to perform a risk analysis, create a risk management plan, check current policies and procedures to ensure compliance with the HIPAA Regulations, offer workforce training on HIPAA guidelines, audit all third-party arrangements to make certain proper business associate agreements are ready, and be sure that any HIPAA violations by staff members are reported to OCR.

Ransomware is becoming one of the most frequent cyber-attacks and makes patients very vulnerable. Ransomware attacks cause stress for patients who do not have access to their medical documents, as a result, they may make the most appropriate decisions regarding their health and wellness. Healthcare organizations should know the importance of these attacks and should have safety measures in place to make sure patients’ protected health information is not subjected to cyber-attacks including ransomware.

This is OCR’s second incident of a ransomware attack that had a financial penalty issued for HIPAA Regulations noncompliance and is one of many investigations that discovered a failure to adhere to the risk analysis requirement of the HIPAA Security Guideline. In case an extensive organization-wide risk analysis is not carried out, risks and vulnerabilities to the integrity, confidentiality, and availability of ePHI will probably remain. Soon, malicious actors will find and exploit the vulnerabilities.

The Office of the National Coordinator for Health Information Technology (ONC) and OCR have created a Security Risk Assessment Tool and have released guidance on executing risk analyses, and the National Institute of Standards and Technology (NIST) has just released a final guide on HIPAA Security Regulation implementation, which includes instruction on performing risk analyses.

Empress Ambulance Service Pays $1.05 Million to Settle Class Action Lawsuit

Empress Ambulance Service, an ambulance firm that services many locations in New York as Empress EMS, has proposed to pay $1.05 million as a settlement for claims it was unable to employ appropriate cybersecurity procedures to protect the sensitive data of patients. In July 2022, Empress EMS experienced a Hive ransomware attack that resulted in file encryption and theft of sensitive patient information. The Hive group posted some of the records on its data leak site; nevertheless, Empress EMS gave ransom payment, and the files were removed from the leak website. The forensic investigation showed that the PHI of 318,558 individuals was exposed in the attack.

Empress EMS faced a few due to the data breach and offered a settlement to take care of the claims with no admittance of any wrongdoing. According to the terms of the settlement, class members – those who received notification from Empress EMS concerning the data breach – are eligible to file claims for around $10,000 for a refund of documented expenses suffered because of the data breach, for instance, fraudulent fees, tax and credit expenditures, professional charges, and identity theft damages.

Alternatively, class members may receive a cash payment, which will be compensated pro rata after deducting legal fees and claims are deducted from the settlement fund. When the claims go over the total settlement, they shall be paid pro rata. There will be no cash payments. The negotiation also includes one year of identity theft protection and credit monitoring services, which include a $1 million identity theft insurance policy. The last day to object to or exclude from the arrangement is March 8, 2024, valid claims should be sent in by April 8, 2024, and the schedule of the final approval hearing will be on April 3, 2024.

Raise the level of HIPAA Awareness in your organization with Learner-Friendly, Comprehensive and Affordable HIPAA Training.


Please enable JavaScript in your browser to complete this form.

Ryan Coyne

Ryan Coyne is a results-driven leader in the healthcare compliance industry, specializing in regulatory compliance, compliance training, and assisting healthcare organizations and business associates in achieving and maintaining compliance. With a deep knowledge of healthcare regulations and a keen understanding of the challenges faced by the industry, Ryan has developed a reputation as a trusted advisor and advocate for ethical and compliant practices in healthcare. Ryan has successfully advised and guided numerous healthcare organizations, business associates, and healthcare professionals on achieving and maintaining compliance with regulatory training requirements. Ryan's professional focus is using his in-depth expertise and leading a world class team of subject matter experts at ComplianceJunction in regulatory compliance to help organisations navigate the complex landscape of ensuring staff adhere to healthcare regulations. You can connect with Ryan via LinkedIn and follow on Twitter

Raise the level of HIPAA Awareness in your organization with Learner-Friendly, Comprehensive and Affordable HIPAA Training.

Comprehensive HIPAA Training

Used in 1000+ Healthcare Organizations and 100+ Universities

    Full Course - Immediate Access

    Privacy Policy