HIPAA Rules on Ransomware Confirmed by OCR

Following the recent WannaCry ransomware attacks, the Department of Health and Human Services’ Office for Civil Rights (OCR) was particularly active. OCR sent out warnings, updates, and threat information related to WannaCry ransomware.

OCR also took the attacks as an opportunity to remind covered entities of HIPAA Rules on ransomware and that HIPAA requires them to report attacks.

Ransomware attacks on healthcare organizations have increased significantly over the past 12 months, although relatively few covered entities have reported those attacks to OCR. HIPAA Rules on security incidents are quite clear, but there appears to be some confusion over ransomware. Ransomware encrypts data in order to extort money out of victims. Victims are prevented from accessing their files, but ransomware does not typically give the attackers access to the encrypted data.

Data may not be viewed or stolen in the attacks, but OCR confirmed that ransomware attacks are usually reportable incidents. That means OCR must be notified of an attack if ePHI has been encrypted and an attack also warrants the sending of breach notification letters to patients. Those notifications must be issued without unreasonable delay, and certainly no later than 60 days following the discovery of an attack.

The exceptions would be if covered entities had encrypted their ePHI prior to the attack, using an encryption method that meets NIST specifications or if the covered entity can demonstrate there was a low probability of ePHI compromise.

OCR has previously confirmed HIPAA Rules on ransomware and produced a factsheet for covered entities explaining how HIPAA Rules apply, what should be done following a ransomware attack, and how covered entities can determine whether breach notifications must be issued.

In its recent series of updates and alerts about WannaCry, OCR also reiterated the need for covered entities to report ransomware attacks to their local FBI field office and to share threat information with other covered entities via an Information Sharing and Analysis Organization (ISAO).

OCR also explained that the sharing of this information must not include the sharing of any PHI. Doing so would be a violation of the HIPAA Privacy Rule.

About Ryan Coyne 218 Articles
Ryan Coyne is a results-driven leader in the healthcare compliance industry, specializing in regulatory compliance, compliance training, and assisting healthcare organizations and business associates in achieving and maintaining compliance. With a deep knowledge of healthcare regulations and a keen understanding of the challenges faced by the industry, Ryan has developed a reputation as a trusted advisor and advocate for ethical and compliant practices in healthcare. Ryan has successfully advised and guided numerous healthcare organizations, business associates, and healthcare professionals on achieving and maintaining compliance with regulatory training requirements. Ryan’s professional focus is using his in-depth expertise and leading a world class team of subject matter experts at ComplianceJunction in regulatory compliance to help organisations navigate the complex landscape of ensuring staff adhere to healthcare regulations. You can connect with Ryan via LinkedIn https://www.linkedin.com/in/ryancoyne/ and follow on Twitter https://twitter.com/ryancoyne