Category: HIPAA News

OSHA is important because of its role in driving the execution and reinforcement of security and health standards, resulting in a significant decline in workplace fatalities, accidents, and health problems. Furthermore, OSHA’s Outreach Training initiatives have efficiently heightened awareness concerning workplace threats, their identification, and the precautionary measures required to mitigate them.

• Established under the OSH Act, OSHA came into existence in 1971 with the aim of addressing the rising occurrences of workplace injuries, illnesses, and fatalities.
• Since the formation of the Administration, OSHA has reached notable achievement, reportedly decreasing workplace injuries and health issues by 40% and fatalities by 60%. OSHA’s primary objective is to minimize human and economic costs linked to avoidable workplace injuries and health problems.
• OSHA’s preliminary standards were taken from established security guidelines used by organizations including the National Fire Protection Administration.
• Compliance with OSHA requirements was at first voluntary however these were later modified to penalize recurrent offenders and organizations known to put workers in danger.
• OSHA offers training, education, and support to employers, ensuring security and health-associated activities among employees.
• Within the healthcare sector, OSHA’s standards are important in safeguarding workers from potential risks such as exposure to infectious illnesses, injuries resulting from patient handling, and incidents of violence in the workplace.
• States are allowed to implement their own OSHA programs as long as the safety and health standards meet or exceed federal standards.
• States have the liberty to implement their OSHA programs, provided they meet or surpass the safety and health standards of the federal government.
• OSHA standards are applicable to all employers in the private sector and federal government organizations, besides those subject to regulation by other government agencies, for example, the Department of Energy.
• OSHA has the authority to issue financial penalties for violations of any standard, irrespective of whether it results in an injury, sickness, or death. This underscores the importance of keeping OSHA compliance requirements.

A Quick Guide to OSHA

President Nixon signed the Occupational Safety and Health Act (OSH Act) in December 1970. OSHA’s primary objective is to curtail the human and economic toll stemming from avoidable mishaps and ailments in the workplace. OSHA’s preliminary standards were drawn from established safety guidelines originally issued by agencies such as the National Fire Protection Administration. Later, these standards were adapted to address well-documented causes of health concerns, for instance, the risks linked to exposure to asbestos.

Initially, adherence to OSHA standards was a voluntary endeavor, with inspections reserved for instances of serious accidents and recognized threats. Nevertheless, the enforcement approach gradually transformed to focus on repeat violators and enterprises that deliberately exposed their employees to risks. OSHA’s role extends beyond establishing standards; it also includes offering training, outreach, schooling, and support to companies, all while motivating workers to engage in safety and health-associated projects.

The standards set up by OSHA are applicable to all employers in the private sector and all federal government institutions, except in cases where workplace security is controlled by another federal agency like the Department of Energy. Employees working for state and local government agencies may not always be subject to federal OSHA regulations. However, in states with an approved OSHA program meeting or surpassing federal safety and health standards, these employees may benefit from the protection of OSHA programs.

Why the Healthcare Sector Needs OSHA

In the healthcare industry, OSHA’s standards include most injury and sickness cases – from protected walking areas to radiation exposure. A lot of OSHA safety and health regulations align with those released by state and federal government bodies such as the Department of Health and Human Services, making it simpler for healthcare companies to concurrently adhere to OSHA and CMS specifications in terms of subjects like emergency readiness organizing and protecting employees against violence in the workplace.

Nevertheless, there are likewise certain areas of OSHA that could make compliance with OSHA difficult for healthcare companies. For instance, OSHA is only applicable to workers, while a lot of healthcare safety and health guidelines are applicable to all workforce members (which include volunteers). Certainly, healthcare companies striving for Joint Commission accreditation not just have to create health and security guidelines for all members of the labor force but also for patients and visitors.

Hence, while it isn’t impossible for healthcare companies to balance several compliance specifications, it’s rather a challenge. Healthcare companies having difficulty overcoming ought to get expert advice from a compliance expert having OSHA knowledge, the CMS specifications for Medicare companies, the Joint Commission accreditation specifications, and state regulations wherever appropriate that preempt government laws.

Pension Benefit Information Reports Theft of PHI of 371,359 Persons in MOVEit Transfer Hack

Pension Benefit Information, LLC, also known as PBI Research Services (PBI), has lately reported the theft of the protected health information (PHI) of 371,359 persons by the Clop ransomware hackers during an attack exploiting a zero-day vulnerability identified in the MOVEit Transfer file transfer program on or about May 31, 2023.

PBI discovered the breach on June 2, 2023, and immediately applied the patch to correct the vulnerability. The forensic investigation showed that Clop hackers accessed one of PBI’s MOVEit Transfer servers from May 29 to May 30, 2023. The stolen files stolen contained names, incomplete mailing addresses, birth dates, and Social Security numbers. PBI stated it doesn’t know of any attempted or actual misuse of the stolen data; nevertheless, as a safety measure, impacted persons received two years of free credit monitoring and identity theft protection services. PBI began sending notifications to the impacted persons on June 4, 2023.

LockBit Ransomware Attack on Panorama Eyecare

Panorama Eyecare was added to the LockBit ransomware group data leak website. The ransomware group claims to have extracted 798 GB of data from the physician management organization based in Colorado. The stolen information includes data from Panama Eyecare’s clients Denver Eye Surgeons, Eye Center of Northern Colorado, 2020 Vision Center, and Cheyenne Eye Clinic & Surgery Center. There was no acknowledgment yet from Panorama Eyecare about the data breach and it is presently uncertain how much patient data was affected.

8Base Ransomware Group Leaks Kansas Medical Center Data

A physician-owned hospital known as Kansas Medical Center located in Andover, KS, was recently included in the 8Base ransomware group’s data leak site. The threat group states the attack happened on June 18, 203, and stole sensitive patient and worker information including names, registration details, addresses, and other data. Kansas Medical Center has made no public announcement about the attack and the number of affected patients is uncertain.

PHI of 168,000 Patients Exposed in Henry Ford Health Phishing Attack

Henry Ford Health based in Detroit, MI recently informed 168,000 patients about an unauthorized person gaining access to worker email accounts that held some of their PHI. A representative of Henry Ford Health stated the unauthorized access happened on March 30, 2023, due to employees responding to phishing emails. The company discovered the attack quickly and secured the accounts; nevertheless, access to patient information was probable. An evaluation of the email accounts showed on May 16, 2023, that they included these patient data: name, birth date, gender, age, phone number, internal tracking number/medical record number, laboratory results, procedure type, date(s) of service, and diagnosis. Henry Ford Health is employing extra security measures to secure against other email account breaches and supplemental training is given to employees.

2022 Malware Incident at IMX Medical Management Services

The medical consulting firm, IMX Medical Management Services based in Malvern, PA, recently announced that malware was discovered on a laptop that possibly permitted unauthorized persons to access the PHI of 7,594 persons. Based on the notification letters, the company detected the malware on September 1, 2022. The forensic investigation showed that the malware was present since June 2022. More malware indicators were likewise discovered on its system in October 2022.

IMX stated the malware was taken away and no more indicators of malware were found since October 2022. The late issuance of notifications was because of the substantial and complex evaluation of the impacted data. IMX stated the malware allowed access to email messages however attachments were not extracted. The exposed data contained names or other personal identifiers together with driver’s license numbers as well as other identification cards. Affected individuals received offers of identity theft protection services.

Storage Unit Bought at Auction Included Boxes of Patient Files

A storage unit that was just bought at an auction was found to contain over 200 boxes of patient documents. The unit was auctioned when no more rental payments were made. The buyer placed a blind bid for the unit and found the boxes of patient documents after buying the unit. The data was associated with patients of East Houston Medicine and Pediatric Center who got treatment from 2009 to 2019. The records contained data like names, driver’s license photos, Social Security numbers, medical backgrounds, and insurance details. The buyer is presently trying to request the healthcare provider to collect the files.

PHI Compromised in Mismailing Incident by Charles George VA Medical Center

Charles George VA Medical Center based in Asheville, NC, reported the exposure of the personal data of 1,541 veterans because of an email mismailing incident. The data compromise was discovered on May 12, 2023, and prompt action was taken to erase the emails that were not opened; nevertheless, the messages had been seen by three veterans. The emails have an attachment that included minimal PHI. Impacted persons were offered free identity theft protection and credit monitoring services.

Hackers Exfiltrated the Information of 1.2 Million Tampa General Hospital Patients

Tampa General Hospital recently reported that hackers acquired access to its system and stole data that include the PHI of around 1.2 million patients. The hospital detected a security breach on May 31, 2023 upon noticing suspicious activity within its system. The impacted systems were quickly taken off the internet to avoid continuing unauthorized access. A third-party digital forensics company investigated the occurrence to find out the nature and extent of the attack.

Based on the investigation, unauthorized persons got access to its system for three weeks from May 12 to May 30, 2023, at that time they extracted files that contain patient data. The data breached in the incident differed from one person to another and might have contained names, telephone numbers, addresses, birth dates, Social Security numbers, patient account numbers, health record numbers, dates of service, medical insurance data, and limited treatment details. Tampa General Hospital stated that the hackers failed to access its electronic medical record system.

Tampa General Hospital mentioned that this attack was an attempted ransomware attack. Although data theft happened, its security systems stopped the encryption of files. More technical security procedures are now put in place to stiffen its systems and stop more data breaches. Network monitoring was also improved to make sure that any potential security breaches are discovered quickly.

The hospital mailed notification letters to impacted persons as soon as contact details were confirmed. Tampa General Hospital stated that impacted persons will be provided free credit monitoring and identity theft protection services.

Data Breach at Claims Processor Affects Idaho Medicaid Recipients

The Idaho Department of Health and Welfare reported the potential access or theft of the personal data of 2,501 Medicaid recipients in a data breach that occurred at Gainwell Technologies, its claims processor. An unauthorized person acquired credentials that permitted access to the Gainwell website and to information including names, billing codes, ID numbers, and treatment data.

The breach was uncovered on May 12, 2023, and after an investigation and evaluation, impacted persons were informed on June 9, 2023. The affected persons received credit monitoring and identity theft protection services.

Utah Department of Health and Human Services Informs 5,800 Health Plan Members About Mailing Error

The Utah Department of Health and Human Services (DHHS) has reported the impermissible disclosure of the protected health information (PHI) of 5,800 Medicaid recipients because of a mailing error. The error resulted in the accidental grouping of the benefit letters together and sent to the wrong persons. Upon discovery of the error on May 8, 2023, the mailing process was stopped to avoid continuing impermissible disclosures.

The benefit letters contained Medicaid benefit details, however, just about 200 of the 5,800 persons impacted had either their Social Security number or Medicare health insurance claim number (HICN) exposed. Those people received free credit monitoring services. The DHHS stated that together with its business associate, Client Network Services (CNSI), they are making sure the error is fixed and system screening and quality standards are improved.

Data Breach Impacts 33,800 Patients at Atlanta Women’s Health Group

Atlanta Women’s Health Group, P.C. lately announced the exposure and potential theft of the PHI of around 33,839 present and past patients as a result of a cyberattack in April 2023. The health group detected a security breach on April 12, 2023, and engaged third-party cybersecurity specialists to find out the nature and extent of the breach. The investigation affirmed that patient data had been accessed, however, the breach report didn’t say if that data was extracted from its systems. As per the Atlanta Women’s Health Group, during the issuance of the notification letters, there was no proof found that suggests the misuse of patient information.

For most patients, the data compromised in the attack only included names, dates of birth, patient ID numbers, and other data that could have been a part of medical files. Third-party cybersecurity specialists helped to apply extra cybersecurity procedures to stop more data breaches. Impacted patients are being urged to keep track of their credit statements, health account reports, and explanation of benefit forms for dubious transactions.

16,000 Blue Cross Vermont Members Impacted by January Cyberattack

Around 16,000 members of Blue Cross Vermont health plans had their PHI exposed in a January 2023 cyberattack. Attackers accessed its systems by exploiting a zero-day vulnerability in Fortra’s GoAnywhere MFT file transfer solution and stole sensitive information including names, dates of birth, addresses, medical data, and insurance details. About 5% of the impacted persons likewise had their financial data stolen.

Around 13,700 of the impacted persons were Vermont Blue Advantage Health Insurance Plans members, about 2,250 persons were Vermont Blue Advantage Plans members, and the rest of the impacted persons were members of other insurance programs. NationsBenefits, the business associate that used the GoAnywhere MFT solution, sent the notification letters to impacted persons. NationsBenefits has provided 24 months of free credit monitoring services to affected individuals.

12,317 New Horizons Medical Patients Affected by Data Breach

New Horizons Medical, Inc. based in Massachusetts, a psychiatry, mental health, and substance use treatment services provider, has lately submitted a data breach report to the Maine Attorney General indicating that up to 12,317 patients were affected. The provider detected unauthorized network access on April 19, 2023, and launched a third-party forensic investigation to find out the nature and extent of the breach of patient information. The investigation showed that unauthorized persons accessed its network from February 12, 2023 to April 23, 2023 and potentially viewed or exfiltrated patient data.

The review of the impacted files showed they included names together with at least one of these types of data: address, birth date, Social Security number, financial account data, driver’s license number, medical insurance plan member ID, medical records number, claims information, diagnosis, and prescription details. New Horizons Medical sent notification letters to impacted persons on June 16, 2023 and offered free credit monitoring and identity protection services to qualified persons. The provider likewise confirmed that extra security and technical measures were implemented to further secure and keep track of its data systems.

CareNet Medical Group Announces Data Security Incident

CareNet Medical Group located in New York has begun informing 3,359 patients about the theft of some of their PHI in a security breach. The breach notice doesn’t mention when the security incident was discovered but the investigation showed on April 26, 2023, that an unauthorized person accessed its network from May 9, 2022 to June 4, 2022. At this time period, the hacker copied files from its network.

The breached data included complete names, addresses, bank account numbers/routing numbers, driver’s license numbers, birth dates, Medicare numbers, medical reference numbers, mobile phone numbers, residence telephone numbers, medical insurance details, Social Security numbers, and email addresses. CareNet sent notification letters to impacted persons on June 2, 2023, and offered free credit monitoring services to those who had their Social Security numbers exposed. The medical provider did not explain why it took about 11 months to know which patient data were compromised.

Vincera Institute Encounters Ransomware Attack

Vincera Institute based in Philadelphia, PA has reported that it encountered a ransomware attack last April 29, 2023. It took quick action to protect its systems to avoid further unauthorized network access and patient data compromise. Cybersecurity experts were called in to look into the incident. Vincera Institute stated in its June 20, 2023 press release that the data breach investigation is in progress, however, it has been confirmed that the attackers got access to sections of its network that held patient data; nevertheless, there is no unauthorized access to patient data or misuse discovered.

The files possibly accessed in the attack included complete names, telephone numbers, addresses, email addresses, birth dates, Social Security numbers, medical backgrounds and treatment data, insurance details, and other data given by patients. Security measures were improved as prompted by the incident, and tracking procedures were enhanced.

The four breach reports submitted to the HHS’ Office for Civil Rights last June 20, 2023 covered Vincera Imaging LLC with 5,000 affected individuals, Vincera Surgery Center with 5,000 affected individuals, Vincera Rehab LLC with 5,000 affected individuals, and Core Performance Physicians, also known as Vincera Core Physicians with 10,000 affected individuals.

 

Hacking incidents in healthcare organizations are escalating. New regulatory and compliance requirements are implemented as a result of the Dobbs and Pixel use. Lawsuits filed against healthcare companies are rising because of privacy violations. The data security strategies and compliance programs of HIPAA-covered entities and other healthcare companies are currently under increased scrutiny, and in the next 12 months there will probably be more enforcement actions and legal cases associated with privacy violations.

The lately publicized BakerHostetler Data Security Incident Response Report (DSIR) discusses these problems and gives information regarding the threat landscape to enable companies to know how to prioritize what they do and invest. This 9th-year report looked at 1,160 security incidents handled by BakerHostetler’s Digital Assets and Data Management Practice Group in 2022.

Following a spike in ransomware attacks in 2021, attacks in 2022 declined. However, ransomware activity increased at the end of 2022 and that spike has carried on in 2023. That spike happened together with more ransom demands, paid ransoms, and ransomware recovery times. In 2022, 6 out of the 8 industries tracked have increased average ransom demand and payment. In healthcare, the average ransom demand in 2022 was $3,257,688, and the average payment grew by 78% to $1,562,141. Over all industries, paid ransoms grew by 15% to $600,688.

There is also an increase in network intrusions. About 50% of all data incidents reviewed in the report involved network intrusions. BakerHostetler remarks that companies are becoming better at identifying and controlling these incidents, with dwell time going down from about 66 days (2021) to 39 days (2022). The time used for controlling dropped from 4 days to 3 days, and investigation time dropped from 41 days (2021) to 36 days (2022).

The upsurge in hacking and ransomware attacks has prompted organizations to spend more money in cybersecurity. Although security protection was improved, cybercriminals have discovered how to avoid those defenses and attack systems. Strategies such as social engineering, MFA bombing, EDR-evading malware, and SEO poisoning have proven successful in 2022.

The cost of cyberattacks grew considerably in 2022. The cost of forensic investigation increased by 20% from 2021 aside from the increased costs of business disruption, data assessments, notification, and indemnity claims. Legal costs associated with data breaches also grew considerably since multiple lawsuits are commonly filed following data breaches.

Data breaches involving 10,001 to 500,000 records have had 12-13 lawsuits filed on average. Even for small data breaches involving below 1,000 records have had 4 lawsuits filed on average. As per BakerHostetler, the number of lawsuits doubled since 2021 and it is now common to see legal action taken following a data breach. Lawsuits for violations of state privacy rules increased as 4 more states passed new privacy laws in 2022. There is one more new privacy law to be introduced in 2023.

In 2022, a Markup/STAT report explained the use of pixels (tracking technologies) on hospital web pages. These snippets of code are usually added to websites to monitor the activity of site visitors to enhance websites and services, however, the code additionally sends identifiable visitor data to third parties. The extent of using these tools without the website visitors’ knowledge got the attention of the HHS’ Office for Civil Rights (OCR) and the Federal Trade Commission (FTC), The two agencies issued guidance on using these tools. OCR and the FTC have stated that Pixel-linked violations of HIPAA and the FTC Act are currently an enforcement top priority. The FTC already took action against entities regarding the use of these monitoring tools. Law companies are quick to file suits against healthcare organizations following these privacy breaches. Over 50 lawsuits were filed against healthcare companies because of Pixel-related breaches from June 2022.

Another study involving the use of Pixels by healthcare companies indicates that about 99% of US non-federal acute care hospital websites use pixels and could send out sensitive information. However, only a few healthcare companies have reported Pixel-linked data breaches to OCR to date. HIPAA enforcement actions by OCR may likely increase and many lawsuits will be filed as a result of these breaches over the next months.

HIPAA-regulated entities and non-HIPAA-regulated entities involved in healthcare will additionally likely face enforcement actions for reproductive health information privacy violations since the FTC and OCR have made reproductive health information privacy an enforcement priority. OCR is still active in its HIPAA Right of Access enforcement initiative, and compliance is still a priority.

BakerHostetler has additionally released an alert concerning HIPAA compliance for non-healthcare organizations, emphasizing that HIPAA is applicable to company-sponsored health plans. Data breaches at employer health plans increased in 2022 and will likely be under greater regulatory scrutiny, not only by OCR but by the Department of Labor as well. State attorneys general have also increased investigations into violations involving HIPAA and state laws in 2022.

BakerHostetler likewise saw a big increase in snooping cases in 2022. These cases involve healthcare workers snooping on healthcare files and trying to reroute controlled substances. The increase shows how crucial it is to make and keep track of logs of system activity to identify malicious insider activity immediately. BakerHostetler remarks that having systems for monitoring system activity anomalies is crucial to quickly discover hacking and ransomware cases.

Protecting an organization is a major challenge. With all the risks involved, spending more money doesn’t necessarily mean more efficient security, stated BakerHostetler’s National Digital Risk Advisory and Cybersecurity team co-leader Craig Hoffman. There are many things to consider including what permitted the security incidents to happen and what was done to deal with the issue. Considering that organizations have limited budgets and employees to implement and manage new solutions, sharing objective information about security incidents, from causes to solutions to effects, can help clients to know which undertakings to prioritize.

Washington is about to enact new legislation that will substantially increase privacy protections for consumer health information in the state and will resolve the existing gap in privacy protections for health information that the Health Insurance Portability and Accountability Act (HIPAA) do not cover.

Representative Vandana Slatter (D-WA) proposed the My Health My Data Act (HB1155). The Act has already passed through the House as well as the Senate with a 27-21 vote. The bill is now back in the House so the Senate amendments can be reviewed. If the bill passes a second vote, it will most likely be signed into law by Washington Governor Jay Inslee.

The My Health, My Data Act seeks to protect the freedom and self-respect of persons whenever they make medical decisions. It avoids vulnerabilities in this technological age that targets and exploits consumers who are not aware of the huge volume of information that are collected.

Data Protected by the Washington My Health My Data Act

The My Health My Data Act is applicable to health information gathered by non-HIPAA-covered entities, such as mobile and web publishers. The extensive definition of health data employed in this Act includes diagnoses, medical conditions, treatment data, and biometric details, together with other information that will allow the identification of a state resident’s past, present or upcoming physical or mental health.

Health data is defined as any information that relates to the following:

• Patient’s medical condition, treatment, health status, diagnoses or diseases
• social, behavioral, psychological, and medical interventions
• health-associated operations or procedures
• usage or purchase of medicines
• physical functions, vital signs, and symptoms
• diagnoses or diagnostic tests, treatment or medicines
• data on gender-affirming care
• sexual or reproductive health data
• biometric data
• genetic data
• exact location details that can reasonably show a consumer’s effort to get or receive medical services or goods
• data that is taken or extrapolated from non-medical information

The bill protects location information, when that information is used for making inferences associated with health. Many companies collect location data, even if the data is not used in relation to health. Location data can provide details about when a person has gone to a hospital, pharmacy, reproductive health clinic, or other medical facility. It is required for any company that gathers location data for targeted marketing purposes to follow the My Health My Data Act requirements. The My Health My Data Act is applicable to any entity that conducts business in Washington and collects health data, irrespective of revenue or size.

How Consumer Consent Help Protect Health Data

If approved, state locals can exercise more control over the collection and use of their health data. Before any company could use health data, it must get a person’s consent through an opt-in procedure. There will be restrictions on the use of health data according to the specifics of the consent.

When getting consent, it must be clearly explained to the consumer what they are agreeing to, and consent should be acquired voluntarily. The same consent requirements apply to the sharing of health data and when the collecting company plans to sell the information to a third party, it must get written authorization from the consumer. The entity must state the reason for selling the data when getting consent and the details of the entity or entities buying the data. It must provide the contact information of those entities to the consumer. Consumers can withdraw their authorization, halt any processing of their information, and have that information deleted. Entities should also give a clear privacy policy to consumers and follow a methodology for processing consumer information requests, which include requests for data access, withdrawal of permission, and data deletion.

Legal Action on My Health My Data Act Violations

Before the approval of privacy legislation, usually, businesses are being protected from consumers who take legal action over privacy violations. There are no such restrictions in the My Health My Data Act. Consumers are allowed to take legal action against violators of the My Health My Data Act. As long as a Washington resident could show proof of harm due to a violation of the My Health My Data Act, taking legal action to get damages is allowed under the general consumer protection regulations in the state.

Changes to the American Data Privacy and Protection Act

Last March, the U.S. House of Representatives’ Committee on Energy and Commerce conducted its third meeting before releasing a new version of the American Data Privacy and Protection Act (ADPPA). ADPPA is about to become the first, all-inclusive federal privacy law in the United States.

Greater privacy protection is needed for people in the U.S. Big tech companies collect big volumes of sensitive information and there is little control over the collection, use, and sharing of consumer data. There is increasing concern about the collected data on minors and their usage, the serving of targeted ads to teens and children depending on the personal data gathered by tech companies, and the sheer volume of data that is being accumulated on all U.S. citizens.

Presently, privacy policies are enforced at the state level and could vary from state to state. ADPPA wants to address this by putting limitations on the collection and usage of consumer information at the federal level and changing the present patchwork of state privacy legislation. The Committee on Energy and Commerce approved ADPPA on July 20, 2022, with a 53-2 vote. However, the bill was not approved by the House or Senate floors in the most recent Congress. There is strong support for the bill, but not strong enough in its present form to be signed into law.

Last March 1, 2023, the Committee hearing began discussing about federal privacy legislation again. Subcommittee Chair Gus Bilirakis (R-FL) and Ranking Member Jan Schakowsky (D-IL) stated there is a great need to pass this federal privacy. There was an agreement among subcommittee members on the need for federal privacy legislation and the answer could well be the ADPPA. However, views differ on what should be included in the privacy legislation. Substantial changes are necessary before signing ADPPA into law.

The Committee conducted one more hearing on March 23, 2023 that looked at immensely popular applications and how Congress could protect American data, deal with data-sharing issues, and keep children safe online. TikTok CEO, Shou Zi Chew, spoke in front of the Committee for hours but seemed unable to convince the Committee that TikTok was a  safe platform and that it was not gathering information and sharing that data with the Chinese government. The Restricting the Emergence of Security Threats that Risk Information and Communications Technology (RESTRICT) Act was proposed in March 2023 particularly to deal with this threat. It would authorize the government to prohibit IT products like TikTok should they pose a risk to national security. Although the Biden Administration supports the RESTRICT Act, it does not tackle domestic data privacy concerns and the present digital system where only a few rules apply to the collection, use, and sharing of consumer data.

A new ADPPA draft is expected soon, as Chair Cathy McMorris Rodgers (R-WA) of the Committee on Energy and Commerce reportedly penned the last few significant changes to the bill. One of the main points is the preemption of state legislation, which backers say is important for small companies that are disproportionately loaded by the present patchwork of state legislation. Nevertheless, progressive states with stricter privacy policies like California would likely have weakened consumer privacy policies because of ADPPA. Since the privacy law sets protections in stone, improving protections, later on, would be difficult once ADPPA is approved. Nancy Pelosi, (D-CA) stated that she would not support ADPPA as it is today for this reason.

It’s still uncertain whether the new version of ADPPA will be signed into law, but the changes are necessary to get ADPPA through Congress and the Senate.

The Secretary of the Department of Health and Human Services (HHS) made an announcement that the COVID-19 Public Health Emergency that will expire on May 11, 2023 will not be renewed. According to the HHS’ Office for Civil Rights (OCR), the issued Notifications of Enforcement Discretion as a response to the COVID-19 Public Health Emergency are due to expire on May 11, 2023.

The OCR issued four Notifications of Enforcement Discretion in 2020 and 2021 as a response to the COVID-19 Public Health Emergency and to support the healthcare industry during the pandemic. With the Notices of Enforcement Discretion, financial penalties are not imposed by OCR when certain provisions of the HIPAA Security, Privacy and Breach Notification Rules are violated. The leniency allowed by OCR is applicable to the following:

• Community-based COVID-19 testing areas
• uses and disclosures of protected health information (PHI) by business associates for public health monitoring activities
• the usage of online or web-based booking apps for getting   appointments for COVID-19 vaccinations
• usage of telehealth services that would not normally be HIPAA-compliant.

OCR stated before that enough time will be given to healthcare companies to  comply with the HIPAA Rules with respect to telehealth. When the notice of enforcement discretion expires on May 11, 2023, there will be a 3-month or 90-day transition period, during which time  HIPAA-covered entities will not be issued financial penalties for non-compliance with the HIPAA Rules associated with the provision of telehealth services. The transition period is from May 12, 2023 to August 9, 2023.

The transition period given to healthcare companies is to allow them to apply necessary changes to their operations to make their telehealth service private,  secure, and compliant with HIPAA regulations.

From the time the telehealth Notice of Enforcement Discretion became effective, healthcare companies could utilize any non-public-facing remote communication platform for video and audio communication to offer telehealth services, even when those platforms aren’t HIPAA compliant.  For example, when a healthcare provider uses a communication platform without signing a business associate agreement (BAA) with the owner of the communication platform, the latter will not be issued a financial penalty.

Since the Notice of Enforcement Discretion will be expiring soon, healthcare companies should now sign a HIPAA-compliant BAA with the owner of the communication platform if they want to continue using the service after August 9, 2023. Healthcare providers must do what is necessary to get a BAA or shift to a HIPAA-compliant communications platform immediately to avoid interruption to their telehealth services and to avert the risk of financial penalties for non-compliance.

Read the OCR announcement here.

Microsoft, Fortra, and Health-ISAC Join Forces to Disrupt Malicious Use of Cobalt Strike

The Health Information Sharing and Analysis Center (Health-ISAC), Microsoft’s Digital Crimes Unit, and the cybersecurity company Fortra are working together to stop malicious actors from illegally using Cobalt Strike, the legit red team post-exploitation tool, for sending ransomware and malware.

Cobalt Strike consists of tools utilized for adversary simulation that may be employed for duplicating the tactics and techniques of advanced threat actors in a system and copying silent, long-term threat actors with continuing access to systems. The tool was used first in 2012 and it quickly became a  widely used tool by penetration testers. Cobalt Strike has become more sophisticated and has improved functionality. It has become part of the cybersecurity portfolio of Fortra.

Although the tool helps in red team operations, there are cracked copies of the tool circulating within the cybercriminal community. More cybercriminals are using the tool for malicious purposes. Several ransomware groups use Cobalt Strike including Lockbit and Conti. According to Microsoft reports, Cobalt Strike was used in over 68 ransomware attacks on healthcare companies located in over 19 countries.

Cobalt Strike attacks resulted in:

• blocked access to electronic health records
• critical patient care services disruption
• Delays to diagnosis and treatment
• Million-dollar cost to healthcare companies for recovery and repair

Cobalt strike was likewise employed in the damaging attack on the Health Service Executive in Ireland and the recent ransomware attack on the Costa Rica Government.

To avoid the illegal usage of Cobalt Strike, Fortra applied strict vetting processes for new clients. Still, malicious actors use older, cracked versions of Cobalt Strike to get backdoor access to systems for installing malware and hastening the use of ransomware. Microsoft states the malicious actors using the tool aren’t identified, however, malicious infrastructure employed by those malicious actors was discovered in China, Russia, and the U.S. Besides the financially driven cybercriminals misusing the tool, there are advanced persistent threat actors from China, Russia, Iran, and Vietnam that utilized cracked versions of Cobalt Strike.

Together, Microsoft, Health-ISAC and Fortra have increased their efforts to stop the use of cracked, legacy copies of Cobalt Strike and misuse Microsoft programs. Microsoft is trying to fight cybercrime by altering the malware families’ command-and-control infrastructure and removing illegal, older copies of Cobalt Strike to stop malicious actors from further usage.

The U.S. District Court for the Eastern District of New York released a court order on March 31, 2023 permitting Microsoft, Health-ISAC and Fortra to mess up the infrastructure utilized by criminals to launch attacks in over 19 countries. Associated Internet Service Providers (ISPs) will get notifications regarding the malicious use of the tool.   Computer emergency readiness teams (CERTs) will help take down the infrastructure from the web and disrupt cracked legacy Cobalt Strike copies and breached Microsoft software programs. Fortra, Microsoft, and Health-ISAC will additionally be joining forces with the National Cyber Investigative Joint Task Force (NCIJTF), the FBI Cyber Division, and Europol’s European Cybercrime Centre (EC3) to stop Cobalt Strike misuse.

Hindering the use of cracked legacy  Cobalt Strike versions will substantially stop these illegal copies and limit their use in cyberattacks, compelling criminals to re-assess and alter their tactics. Microsoft and Fortra also filed Copyright claims against misuse of altered software code for intended harm.

Two reports published by the Department of Health and Human Services’ Office for Civil Rights (OCR) had been submitted to Congress. The reports offer information about data breaches, the status of HIPAA Privacy and Security Regulation compliance, and HIPAA enforcement activity for 2021.

As per OCR, in 2021, OCR got 609 reports of big data breaches involving 500 or more persons and those data breach incidents impacted 37,182,558 persons. OCR likewise got 63,571 data breach reports involving less than 500 persons, which are not reported to the public. These smaller breaches affected 319,215 persons. So, there were a total 64,180 data breaches in 2021 impacting 37,501,772 persons.

The number of data breaches reported to OCR using the OCR HIPAA Breach Web Site is just 714 data breaches for 2021. This number is very different from the abovementioned data breach statistics. That is because eventhough OCR investigates all reported breaches, it only reported to Congress the data breaches that happened in 2021 and went on into 2021. There were 105 data breaches reported to OCR in 2021 that happened and ended in 2021.

All data breaches involving at least 500 records are investigated by OCR. HIPAA compliance audits are done on all of the breaches to find out if there was noncompliance with the HIPAA Rules that resulted in the breach. In 2021, OCR started investigating all 609 data breaches and the 22 data breaches affecting less than 500 persons. OCR marked 554 data breach investigations as completed in 2021 because the investigations were closed without additional action since OCR did not find any HIPAA violations, or if there were HIPAA violations found, they were settled by means of voluntary compliance, technical support, or corrective action plans and resolution agreements.

The tweaked information indicate there was a 7% yearly decrease in data breaches involving at least 500 records in 2021 when compared with 2020, and a 4% decrease in smaller data breaches. In contrast, large data breaches increased by 61% in 2020 while small data breachesa increased by 6%. From 2017 to 2021, there was a 5.4% increase in small data breaches and 58.2% increase in large data breaches.

In 2021, 75% of big data breaches were due to hacking/IT incidents with 95% of the impacted persons had their breached data mostly saved on network servers. 19% of breaches and 4% of affected persons were due to unauthorized access/disclosure cases, 3% of breaches were due to theft (with less than 1% of impacted persons), 1% were due to loss of PHI (with less than 1% of impacted persons), and 1% were due to improper disposal of PHI (with 1% of impacted persons). Unauthorized access/disclosure cases caused almost all small breaches and those breaches usually concern paper documents.

Healthcare providers submitted 72% (437) of the data breach reports in 2021 with 24,389,630 impacted persons. Health plans submitted 15% (93) of the breach reports with 3,236,443 impacted persons. Business associates submitted 13% (977) of the breach reports with 9,554,023 impacted persons. Healthcare clearinghouses submitted less than 1% (2) of the breach reports impacting 2,462 persons.

Biggest Data Breaches in 2021 Per Breach Category

Hacking/IT Incident (Hacked Network Server) – 3,253,822 individuals affected
Unauthorized Access/Disclosure (Software Misconfiguration Exposed ePHI) – 326,417 individuals affected
Improper Disposal (of hard drives with ePHI) – 122,340 individuals affected
Theft (of laptops and paper documents in burglary) – 21,601 individuals affected
Loss of PHI (missing medical records) – 14,532 individuals affected

Lessons Realized from 2022 Data Breaches

According to OCR reports, its investigations found that the most prevalent vulnerabilities were noncompliance with the HIPAA Security Rule standards and enforcement requirements. Regulated entities need to reinforce their compliance with the HIPAA Rules, particularly, the Security Rule requirements. OCR’s 2021 breach investigations identified the implementation guidelines of risk management, risk analysis, information system activity assessment, audit management, and access control as requiring improvements.

The most typical remedial steps to breaches involving at least 500 records were:

• Employing multi-factor authentication for remote access
• Modifying guidelines and procedures
• Training or retraining employees with access to PHI
• Giving complimentary credit monitoring and identity theft protection services to clients
• Using encryption technologies
• Imposing sanctions on employees who violated guidelines and procedures for getting PHI from facilities or who wrongly viewed PHI
• Altering passwords
• Carrying out a new risk analysis
• Changing business associate agreements to add more specific terms for the safety of health data

Whenever serious HIPAA violations are discovered and/or corrective action was not proactively taken to address data breaches, OCR will enforce corrective action plans and issue financial penalties. In 2021, OCR had two data breaches resolved with a total of $5.1 million of financial penalties paid and corrective action plans implemented. The settlement with Excellus Health Plan resulted in the payment of a $5,100,000 financial penalty to settle the HIPAA violations that caused a data breach in 2015 impacting 9.3 million persons. Peachstate Health Management (dba AEON Clinical Laboratories) paid $25,000 in penalties to settle HIPAA Security Rule violations.

Read OCR’s Annual Report to Congress on Breaches of Unsecured Protected Health Information (PDF) here 

Insufficient Funding Impede OCR’s Capability to Implement HIPAA

The HHS’ Office for Civil Rights (OCR) has sent a report to Congress detailing its 2021 HIPAA enforcement activities, which gives information into the status of compliance with the HIPAA Security, Privacy, and Breach Notification Regulations. The report states that the resources of OCR are under strain, and if Congress does not increase its funding, OCR will have difficulty fulfilling its task to implement HIPAA compliance, considering the rise in reported data breaches and HIPAA problems.

OCR reports substantial growth in data breach reports and HIPAA complaints, with data breaches involving 500 and up records escalating by over 58% from 2017 to 2021. HIPAA complaints grew by 25% from 2020 to 2021, though from 2017 to 2021, OCR did not get higher appropriations, with Congress merely adding funding consistent with inflation.

In case Congress cannot increase OCR’s funds, the financial strain can be eased by means of enforcement actions; nevertheless, OCR has seen funding by way of a drop in enforcement after re-evaluating the terms of the HITECH Act and identifying its being misinterpreted in 2009, leading to the highest penalty amounts in three of the four penalty tiers being considerably lowered. To deal with this and raise funding, OCR requested Congress last September 2021 (HHS FY 2023 Discretionary A-19 Legislative Supplement) to increase HITECH civil monetary penalty limits, because, without such a raise, OCR’s employees and resources will be seriously strained, particularly in a time of considerable increase in cyberattacks on the healthcare industry.

25% Yearly Increase in Complaints Regarding HIPAA Violations

Complaints on potential violations of the HIPAA and HITECH Act grew by 25% year-over-year in 2021. 26,420 of the 34,077 complaints or 77.5% were settled in 2021. 20,611 of the complaints or 78% were closed even without starting an investigation. OCR mentioned that action on complaints can only be taken

• when the HIPAA violation happened following the deadline of compliance
• when the complaint involves a HIPAA-covered entity, where a HIPAA violation seems to have happened
• when the complaint is filed within 180 days after the complainant knew about the violation (except if the complainant shows good faith in not reporting the violation within 180 days).

The following are typical reasons for closing complaints without conducting any investigation:

• the complainee is not a HIPAA-regulated entity
• allegations didn’t involve HIPAA violations (3%)
• due to untimely complaints (1%)

OCR stated that complaints against HIPAA-regulated entities were settled through

• offering technical support instead of an investigation – 4,139 complaints
• taking corrective action – 714 complaints
• taking technical support after starting an investigation – 789 complaints

Initiated compliance investigations decreased by 10% year-over-year. There were only 1,620 compliance investigations begun due to complaints. 50% of the complaints were resolved because there was no violation found. 44% of the complaints were settled by taking corrective action, 6% of the complaints were settled by getting technical support after investigation. 13 complaints were settled after paying a total of $815,150 in penalties and taking a corrective action plan. Two complaints were settled by paying civil monetary penalties of $150,000.

There were 674 compliance investigations started that did not have any complaints involved. 609 were because of big data breaches, 22 were because of small data breaches, and 43 were because of incidents that caught OCR’s attention through other means, for example, media reports.

In 2021, OCR resolved 573 (83% of the) compliance investigations by means of corrective actions or paying civil monetary penalties. Two compliance investigations led to a resolution settlement after issuing $5,125,000 in financial penalties and imposing corrective action plans. The other 17% of compliance investigations were resolved by means of technical assistance (3%), lacking proof of HIPAA violations (11%), or jurisdiction to investigate was lacking (3%). OCR stated its HIPAA compliance review program has stalled because of insufficient financial sources.

State attorneys general in Ohio and Pennsylvania fined DNA Diagnostics Center (DDC) with $400,000 for violating state legislation on personal data privacy. This U.S. private DNA testing laboratory encountered a breach of the personal data of approximately 46,000 residents in Pennsylvania and Ohio, and around 2.1 million people throughout the U.S.

DDC discovered the data breach on August 6, 2021 upon noticing suspicious activity in its archived databases. The investigation confirmed that unauthorized individuals accessed the databases from May 24 to July 28, 2021. Selected folders and files were extracted. The databases included the sensitive data of 33,300 Pennsylvania residents and 12,600 Ohio residents, who had gotten DNA testing services from 2004 to 2012. The data included sensitive customer data such as names, payment details, and Social Security numbers.

The databases were acquired from a firm named Orchid Cellmark, which DDC obtained in 2012. The archived databases were not utilized for business and, as per DDC, were unintentionally moved as included in the acquisition, without DDC’s knowledge. After nine years, DDC still did not know that the databases remained in its systems. DDC stated it had performed penetration tests and a stock review before the data breach happened, however, those checks and tests simply identified active consumer information and didn’t show the existence of the archived information on its systems.

Before the data breach, DDC hired a third-party company to perform data breach tracking. That company found the data breach and tried to get in touch with DDC on several instances through automated email notifications, however, employees did not answer for two months. Throughout those two months, Cobalt Strike malware had been installed on the system, and information was extracted. The breach investigation affirmed that an unauthorized third party had signed in by using a VPN on May 24, 2021, making use of a DDC user credential. Active Directory information was collected from a Domain Controller that supplied password data for every account in the system. The threat actor used VPN that DDC doesn’t use because DDC had moved to a different VPN. The unauthorized third party employed a trial account having administrative privileges to attain continued access and implement Cobalt Strike inside its system. Five compromised servers that stored backups of 28 directories and a decommissioned server were employed to extract the information. The threat actor then told DDC to pay the ransom in exchange for the restoration and deletion of the stolen information. DDC paid the ransom.

The state attorneys general’s investigation found that DDC was involved in misleading or unjust business by means of material misrepresentations in its client-facing privacy policy relating to the protection of its clients’ personal data. It was additionally supposed that DDC did not take reasonable actions to identify and stop unauthorized access to its computer systems. Therefore, involved unjust and fake cybersecurity strategies which exposed client information to unauthorized access and stealing. The state AGs decided that those problems constituted unjust trading procedures and violated state Consumer Protection Legislation.

DDC opted to resolve the investigations without admitting any wrongdoing. Considering the stipulations of the settlement, DDC decided to pay Pennsylvania and Ohio $200,000 each, carry out and maintain extensive information, and security data, execute detailed threat examination annually, assign risk-appropriate resources to protect the personal information of consumers, and perform an I.T. security program evaluation yearly to analyze the usefulness of the data security plan.

Acting Attorney General Henry states that when criminals get access to more personal data, the person’s data becomes more prone to stealing. Hence, the Attorney General’s Office did something with the help of Attorney General Yost in Ohio. I am proud of the work our agents and attorneys do every day to protect Pennsylvanians’ most sensitive information.

Regal Medical Group Facing Multiple Lawsuits Over 3.3 Million-Record Ransomware Attack

Regal Medical Group and affiliated healthcare providers are facing several class action lawsuits as announced on February 1, 2023. A ransomware attack in December 2022 resulted in the potential theft of the protected health information (PHI) of approximately 3,300,638 people.

The attack impacted the Heritage Provider Network, Regal Medical Group, and a number of affiliated healthcare companies, such as A Medical Group, Inc., Lakeside Medical Organization, ADOC Acquisition Co., Affiliated Doctors of Orange County, and Greater Covina Medical Group Inc. The attack was discovered on December 2, when staff members began having problems accessing information.

The forensic investigation showed the ransomware attack began on or before December 1 and the attackers exfiltrated sensitive data from its servers. The compromised files contained PHI including names, telephone numbers, addresses, birth dates, diagnosis and treatment data, lab test data, prescription information, radiology reports, Social Security numbers, and medical plan member numbers. Impacted persons received a membership to a credit monitoring service for 12 months.

Filing multiple lawsuits is now common following healthcare data breaches. Hence, it is not surprising that a lot of lawsuits were filed following an attack of this size. One of the major issues brought up in the lawsuits was the way the attackers had acquired access to a great deal of information, a lot of which was highly sensitive information and could be misused in a variety of ways. The lawsuits had been filed against Regal Medical Group and the Heritage Provider Network in the California superior state court and federal court. The lawsuits’ claims include unjust enrichment, negligence, negligence per se, unfair business practices, and breach of implied contract. The lawsuits allege violating the following legislation: the California Confidentiality of Medical Information Act, the California Consumer Privacy Act of 2018, the FTC Act, the Health Insurance Portability and Accountability Act, and the Unfair Competition Law.

The lawsuits furthermore raise the issue of the delay in issuing notifications concerning the breach. The data breach happened on December 1, 2022, but notifications were sent starting on February 1, 2022. Although the notifications were sent within the period of time permitted by the HIPAA Breach Notification Rule, that Rule additionally says that notifications must be distributed with no unnecessary delay. One lawsuit additionally disputes the details given in the breach notifications, which did not give complete details about the breach, for instance, the length of time the attackers got access to the stolen information.

The Timothy Head vs. Regal Medical Group Inc, Heritage Provider Network Inc. (Cole & Van Note) lawsuit allege the defendants deliberately, willfully, recklessly, or negligently didn’t take and apply sufficient and reasonable steps to make sure to protect representative plaintiff(s)’ and class members PHI/PII. The lawsuit also alleges the defendants failed to encrypt information.

The same claims are presented in these lawsuits: David Rodriguez v. Regal Medical Group and Sam Abedi And Farnaz Doroodian v. Heritage Provider Network, Inc. and Regal Medical Group, Inc. The defendants knew very well the high incidence of data breaches and acquired the tools to secure information but did not invest enough in data protection, vulnerability remediation, employee training, and testing security settings.

The Lynn Austin vs. Regal Medical Group, Inc. (Parker & Minnie, LLP & Mason LLP) lawsuit alleges the plaintiffs have dealt with actual and tangible harm, which include out-of-pocket expenditures, loss of invaluable rights and protections, increased stress, anxiety, fear, and risk of future violations of privacy, and emotional and mental distress.

The lawsuits want a jury trial, class action certification, injunctive relief, and actual and punitive damages, which include a court order to forbid the defendants from doing unlawful acts and misleading business practices and to make sure that a detailed information security program is applied to safeguard against potential data breaches.

As per the Federal Trade Commission’s Health Breach Notification Rule, vendors of personal health information and similar entities need to notify consumers in case of a breach of unsecured personal data. The rule was approved in 2009, however, compliance was not fully enforced. Recently, the FTC penalized GoodRx Holdings Inc for its noncompliance with the Health Breach Notification Rule. The prescription drug company, GoodRx Holdings Inc, is to pay $1.5 million as a financial penalty.

In September 2021, the FTC released a policy statement stating its intent to begin actively implementing the Health Breach Notification Rule with an emphasis on health applications. HIPAA typically does not cover health apps and so data breaches are not governed by the requirements of the HIPAA Breach Notification Regulation.

The following guidance documents were published in January 2022:

• Health Breach Notification Rule: The Basics for Business
• Complying with FTC’s Health Breach Notification Rul

The two documents clearly discussed the following:

• which entities are governed by the Health Breach Notification Rule
• what events necessitate the notification of consumers
• how to issue notifications

The first financial penalty was enforced more or less a year after the guidance was approved for the failure to inform consumers regarding unauthorized personal health information (PHI) disclosures to Facebook, Criteo, Google, and others for marketing use.

Telemedicine platform provider, GoodRx is based in Santa Monica, CA. It allows consumers to freely use its website and mobile app to monitor prescription drug costs and get coupons to avail of discounts on medicines. Consumers can also book telehealth consultations and access other healthcare services using the platform. When using the services, consumers give GoodRx their personal and health data. Their data is also collected from pharmacy benefit managers whenever users shop utilizing GoodRx coupons. Over 55 million consumers have already utilized the GoodRx website and mobile application since January 2017.

GoodRx Multiple Privacy Violations and Deceitful Businesses Tactics

A complaint that was filed with the FTC stated that GoodRx violated the FTC Act as well as its own privacy policy because it shared the sensitive personal and medical data of its users with tech companies and social media sites without informing users regarding those disclosures or acquiring permission to do so.

GoodRx advised users of its webpage and mobile application that it will never share their personal health information (PHI) with advertising companies or other entities; nonetheless, the FTC confirmed that from 2017 GoodRx consistently violated that policy and disclosed PHI with third parties like Google, Facebook, Criteo, Twilio, Branch, etc for marketing purposes. Details about users’ medical conditions and their prescribed drugs were disclosed.

The PHI of users was monetized and the information disclosed to Facebook was utilized to send targeted ads to its own users on Meta platforms like Instagram and Facebook. The FTC reported one particular instance from 2019 where GoodRx put together listings of users that bought specific medicines for blood pressure and heart disease, then shared their email, telephone numbers, and advertising IDs to FB to enable the identification of those users to send them targeted health-linked ads.

GoodRx likewise allowed third parties like Facebook to utilize the shared information for their own business. It is making false claims of compliance with Digital Advertising Alliance principles because it doesn’t get consent from users prior to using their health data for marketing reasons. GoodRx additionally displayed a seal of HIPAA compliance on its telehealth services webpage when it is not in compliance with the HIPAA Regulations. The provider also did not follow appropriate policies and procedures to secure the personal and medical data of its users, and simply used formal, written, privacy, and data-sharing guidelines when a consumer watchdog exposed its data practices in February 2020.

The FTC stated that GoodRx violated the Health Breach Notification Rule for not alerting consumers about the impermissible disclosures of their PHI, not to mention the seriousness of those violations called for a financial penalty. The federal court is about to approve the proposed penalty. Besides the financial penalty, GoodRx is

• forbidden from sharing the medical records of its users for marketing purposes
• instructed to get users’ consent before sharing any data and should direct the third parties to delete health information shared with them
• required to carry out an extensive privacy program.

Cedars-Sinai Medical Center Faces Lawsuit for Privacy Violations by Using Website Tracking Technology

Cedars-Sinai Medical Center has a lawsuit filed against it for allegedly impermissibly disclosing patient information to Meta, Google, and other third parties as a result of using website tracking technologies without entering into a business associate agreement (BAA) with the code vendors or getting patient authorization. In 2022, there was an investigation conducted on the use of website tracking technologies. The results showed nearly 33% of the United States’ top 100 hospitals added pixels or another tracking code on their web pages, enabling the code providers to collect and transmit sensitive information The Cedars-Sinai lawsuit is just one of the many filed cases against healthcare companies and other health-associated firms last year because of tracking technologies used on websites and mobile applications without getting user permission.

The extensive usage of tracking technologies led the HHS’ Office for Civil Rights to publish guidance last December 2022 about using such technologies. The guidance affirmed the capability of any tracking technologies to access data secured by HIPAA using a valid, HIPAA-compliant BAA acquired from the code provider or when patient consent to share HIPAA-covered information is obtained.

On December 30, 2022, the Cedars-Sinai Medical Center case was filed in the California state court. However, it was transferred to the U.S. District Court for Central California in Los Angeles last February 3, 2023. The John Doe v. Cedars-Sinai Health System and Cedars-Sinai Medical Center lawsuit claim privacy violation, intrusion upon seclusion, breach of implied contract, negligence, breach of contract, and breach of the California Invasion of Privacy Act, the California Confidentiality of Medical Information Act, and California Unfair Competition Law.

The lawsuit states the sensitive personal data and medical data of the plaintiff and other patients of Cedars-Sinai were impermissibly shared with Meta, Google, and Microsoft Bing because of the tracking code put on its web page. The lawsuit says that Cedars-Sinai asks patients to check out its website to study medical signs and health conditions, find physicians that can handle particular health issues, and book appointments on the internet. This calls for patients to share their signs or symptoms and send highly sensitive medical data. This the plaintiff did because he thought that privacy was certain.

The tracking technologies put on the website documented individually identifiable information according to user activities and sent that data to firms, such as Microsoft Bing, Meta/Facebook, Google, and social media sites or companies. Based on the lawsuit, this tracking code is like real-time wiretaps on patients’ devices. It enabled marketing firms to use patient data without consent and send them ads related to their medical conditions. The patients were neither advised regarding those uses nor disclosures.

The plaintiff is someone that uses Facebook with the ‘Keep Me Logged In’ function activated. He observed a rise in health-related ads since going to the Cedars-Sinai website for additional data on his ailment. A few of the ads were particularly connected to the health condition he looked at the website of Cedars-Sinai.

The focus of the lawsuit is Cedars-Sinai, and not the pixels or code providers. The terms and conditions of the code providers specifically mention that using the code with health information is not allowed. As an example, HIPAA-regulated entities and their business associates cannot use the Google Analytics code on their websites that involve PHI. The lawsuit states that adding the tracking code violates patients’ privacy and additionally comprises a HIPAA Rules violation. The lawsuit seeks class-action status, a jury trial, punitive damages, compensation, as well as injunctive relief.

Satellite Healthcare Breach Impacted 95,000 Individuals

Satellite Healthcare based in San Jose, CA has just reported a breach of the PHI of 95,128 patients to the Texas Attorney General. 22 Texas locals were affected. There are a few facts available concerning the breach at this point because the incident is not yet published on the website of the California attorney general and there’s no note on the healthcare provider’s webpage.

The breach impacted protected health information including names, medical data, health insurance details, and financial details. Notifications were released to affected patients by mail. Satellite Healthcare was contacted for additional data regarding the breach, nevertheless, no instant response was obtained.

Patient Information Exposed in Hacking Incident at Rundle Eye Care

Drs. Keith and Herman Rundle lately reported that unauthorized individuals accessed and potentially stole the protected health information (PHI) of some Rundle Eye Care patients. Based on the breach notification letters, the breach happened “lately” and affected patient names, dates of birth, and treatment data.

Although data theft could have happened, there are no hints of misuse of patient information. As a safety measure against the improper use of patient information, impacted patients have been provided free single-bureau credit monitoring services for A year. Safety precautions were undertaken to reinforce system security.

Although there was no mention of ransomware in the breach notice, the Everest Ransomware Group claimed accountability for the attack and states 30 GB of information was taken, which include tax records, clinical records, and prescription forms.

DCH Health System Detects Insider Data Breach

DCH Health System based in Tuscaloosa, AL lately reported that an ex-employee got access to the medical files of patients with no permission. DCH Health discovered the unauthorized medical record access on December 9, 2022, at the time of a regular privacy review. The review showed that the employee had seen the health records of a patient on December 5, 2022, even without a valid work reason to do so. In the following investigation, DCH Health learned this wasn’t the first occasion that the employee accessed the medical records since the privacy violations were happening starting September 2021. At that time, the information of around 2,530 patients was impermissibly viewed. The types of data compromised included names, dates of birth, addresses, Social Security numbers, diagnoses, dates of consultation, vital signs, prescription drugs, test findings, and clinical/provider notes.

DCH Health stated the employee was promptly suspended when the initial unauthorized access was found and was consequently laid off due to privacy violations. Free identity theft protection services were provided to impacted patients, though DCH Health stated there are no hints that any patient data was or will be misused. DCH Health stated workers will continue to be provided HIPAA and privacy training on suitable access, and the occurrence will be employed to enhance privacy tracking tools and procedures.

 

29,000 Insulet Corporation Customers Affected by Tracking Code Privacy Incident

The medical device company Insulet Corporation based in Massachusetts has just informed 29,000 of its Omnipod DASH clients concerning a new privacy breach. The company already sent a Medical Device Correction letter to customers. Because it is important to apply the update, Insulet Corporation emailed a follow-up receipt acknowledgment request on December 1, 2022.

The email messages contained a clickable hyperlink that brought clients to a web page for verifying receipts, but there was a mistake in the configuration of that web page resulting in an impermissible disclosure of the protected health information (PHI) of customers. Every client was emailed a unique web link that contained each one’s IP address, to note if the client was a user of Omnipod DASH and if they are given a Personal Diabetes Manager.

The MDC acknowledgment pages had cookies and trackers embedded in them that transmitted specifics of the web addresses to third-party website performance and advertising partners. Insulet stated the privacy violation was detected on December 6, 2022. The company disabled all tracking technologies on the web pages to stop further exposure of PHI and sent requests to Insulet’s advertising partners to delete the records of the IP addresses and unique web addresses.

4,307 Individuals Affected by Error of Minnesota Department of Human Services Employee

A Minnesota Department of Human Services (DHS) employee made a mistake that led to the impermissible disclosure of the PHI of 4,307 residents of Minnesota. On November 18, 2022, while responding to a client’s request for a copy of their own information, the employee inadvertently provided the billing statements of 4,307 persons who signed up for Medical Assistance.

The investigation did not find any evidence that indicate the download or misuse of information. The patient who received the information informed DHS concerning the mistake and stated the email would be erased. The DHS affirmed that the statements did not contain highly sensitive data, for example, banking data, credit card numbers, and Social Security Numbers. All affected persons received notification letters on January 11, 2023.

Washington Attorney General Bob Ferguson is charging a plastic surgery company for wrongly inflating online review scores, bribing, and frightening patients, and claims the activities of the practice did not comply with the Health Insurance Portability and Accountability Act (HIPAA) Regulations.

The plastic surgery clinic Allure Esthetic based in Seattle and its owner Dr. Javad Sajan are facing a lawsuit filed in the U.S. District Court for the Western District of Washington. Patients and ex-employees submitted multiple complaints alleging that the practice was bribing and threatening patients to keep them from leaving bad reviews on websites like Google and Yelp, and that patients asked to sign non-disclosure agreements (NDAs) prior to getting treatment forbidding them from posting online comments that can hurt the practice by any means. The practice viewed any rating below 4 stars to be a bad review. Attorney General Ferguson stated these practices wrongly inflated its online evaluations.

Based on the lawsuit, over 10,000 patients signed the NDAs that state legal action will be taken against those posting negative reviews. Patients who published bad reviews were purportedly threatened to delete the ratings because if they do not, they will be sued for monetary. In a number of instances, patients were given bribes for deleting negative comments, such as cash and free treatments. Patients that agreed to the payments or free treatments signed another NDA that stated they would pay $250,000 in damages should they post any more bad reviews. Patients had to pay a $100 consultation fee prior to being informed they need to sign an NDA.

The lawsuit additionally claims employees were instructed to post bogus positive feedback online that contained modified before and after photos that showed their treatments were considerably more successful than they really were. When posting bogus reviews, a VPN was utilized to hide the IP addresses of the computers used. The practice is additionally alleged to have requested patients’ rebates without getting their permission, then held on to the rebates. The practice created hundreds of bogus email accounts to sign up for rebate programs meant for actual patients. As a result, the practice got paid thousands of dollars of fake rebates every month.

The lawsuit states that from 2017 to 2019, because of the NDAs, the patients had to get in touch with the practice before posting online any review under 4 stars as the NDAs require the patients to pay the practice monetary damages for any losses when negative ratings were not deleted. The NDAs additionally mentioned that patients should waive their HIPAA privacy rights, saying patients should permit a reply [to the review] from the practice that contains any personal health information (PHI) in case they publish a bad review. The HIPAA Privacy Rule forbids covered entities from giving conditions for treatment, payment, enrollment, or basing eligibility to benefits on a person approving an authorization to disclose PHI. That wording was altered in 2019, however, the NDAs still required it up to March 2022.

Besides the claimed HIPAA violations, it is alleged that the practice and owner have not complied with the Consumer Review Fairness Act (CRFA) and the Washington State Consumer Protection Act (CPA). The lawsuit requests the court to void the NDAs, require the practice to send a notification to all patients that the NDAs are void, and prohibit the practice from using NDAs down the road. The practice is to pay monetary damages of around $7,500 per violation and the court has been requested to require the practice to pay $100 to patients as compensation for the consultation fees and give back the rebates that are due to the consumers.

Patients depend on reviews to know whether a healthcare provider is suitable for them. Using legal threats and bribes for manipulating reviews is misleading and causes harm to Washingtonians. AG Ferguson states that these unethical and illegal practices must be stopped.

The HHS’ Office for Civil Rights (OCR) reported its first HIPAA enforcement action of 2023. The agency is reminding HIPAA-regulated entities of their obligation to provide patients and their personal representatives with prompt access to their health documents. Life Hope Labs, LLC, has consented to pay the $16,500 penalty to resolve the case.

43 Enforcement Actions Issued Due to HIPAA Right of Access Failures

The HIPAA Right of Access calls for covered entities to give a copy of an individual’s protected health information (PHI) that is kept in a specified record set in 30 days of receiving that request. In particular instances, it is permitted to delay up to 30 days, as long as the person is informed concerning the cause for the delay and simultaneously advised when the request is going to be fulfilled.

OCR announced a new HIPAA compliance initiative in 2019 focusing on companies that weren’t giving people and their personal representatives a copy of the medical records they asked for promptly, and companies that were billing irrational fees for giving those records. Including the most recent settlement, OCR has charged financial penalties on 43 healthcare companies for probable violations of HIPAA Right of Access.

Life Hope Labs Enforcement Action

Life Hope Labs located in Sandy Springs, GA offers diagnostic lab services. On August 24, 2021, the personal representative of a patient’s estate submitted a complaint with the OCR. The complainant claimed that it filed a request for a copy of the health documents of the deceased with Life Hope Labs on July 7, 2021, however, the provider didn’t give the files. It took Life Hope Labs seven months from the preliminary request to deliver those documents. The complainant, who is the decedent’s daughter, obtained a complete copy of the records on February 16, 2022. OCR established that the delay in delivering the needed information violated the HIPAA Right of Access, as specified in 45 C.F.R. § 164.524.

Life Hope Labs decided to settle the case and paid OCR a $16,500 penalty for the likely violation of the HIPAA Right of Access, without confessing to any wrongdoing. As per the conditions of the settlement, Life Hope Labs needs to undertake a corrective action plan that consists of the need to create, maintain, and modify, as required, written guidelines concerning the HIPAA Privacy Rule, such as the right of patients to get access to and acquire a copy of their PHI and to send those policies to all employees. HIPAA training on those guidelines must additionally be provided to all new staff members within 30 days of starting work. The settlement likewise includes 24 months of supervision.

Access to medical records, including laboratory results, allows patients to better take care of their health, connect with their treatment groups, and follow their treatment plans. The HIPAA Privacy Rule provides individuals and personal reps a right to timely access to their health documents from all covered entities, for instance, laboratories. HIPAA-regulated laboratories should stick to the law and make sure that they are responding promptly to requests for medical records access.

The House and Senate Appropriations Committees has released information about a $1.7 trillion omnibus appropriations bill, which if approved, will make sure that the government stays financed up to September 30, 2023. The Senate has actually begun deliberating the bill and this week, the House will decide on the bill. The bill needs to be approved by the president before the government funding expires.

The 4,155-page bill includes the following healthcare provisions that would enable hospitals and health systems to offer better patient care:

• the prohibition of the 4% Medicare PAYGO slashes to providers
  financial assistance for rural hospitals to ensure their continuous operations
• steps to help states get ready for Medicaid eligibility when the COVID-19 Public Health Emergency concludes
• extensions and broadening of telehealth flexibilities up to December 31, 2024 to ensure that patients get accessible medical treatment through the telehealth and hospital-at-home programs.

The bill will likewise give money for important behavioral health programs and a number of conditions that will grow the medical care staffing.

The bill recommends funding of $120.7 billion for the Department of Health and Human Services. It increases the HHS funds by $9.9 billion more than in 2021. Here are the other changes in funding amounts:

• $100 million more for the Centers for Medicare and Medicaid Services
• $2.5 billion more for the National Institutes of Health to be spent on research on a variety of diseases and medical problems
• $760 million more for the Centers for Disease Control and Prevention, mostly to finance basic public health activities and emergency readiness
• $970 million more for the Substance Abuse and Mental Health Services Administration to fund mental health programs and expanded service access

The Food and Drug Administration (FDA) appropriations bill was approved in September to make sure the FDA would get funds continuously, however, to ensure the bill is approved, the FDA had to remove its recommended medical device cybersecurity requirements, a lot of of which were obtained from The Protecting and Transforming Cyber Health Care (PATCH) Act. The Senate Republican leadership blocked those requirements.

But the good news is that the omnibus appropriations bill contains new requirements in the approval of devices created by medical device manufacturers making sure they satisfy particular minimum standards for cybersecurity. Those conditions will be effective 90 days after passing the bill.

The requirements include presenting a plan to the Secretary of the FDA to check, identify, and handle postmarket cybersecurity flaws and exploits. There must be coordinated disclosure of a vulnerability and relevant processes. The devices and related systems must be safe and include postmarket software and firmware updates and patches. Medical device producers will additionally need to present a Software Bill of Materials (SBOM) to the Secretary of the FDA that consists of all existing, open source, and critical elements utilized by the devices.

The bill requires the FDA to give extra resources and facts on enhancing the cybersecurity of medical devices in 180 days, and yearly afterward, which include details on determining and dealing with cyber vulnerabilities for healthcare companies, health systems, and device producers. In one year, the Government Accountability Office needs to give a report that pinpoints the challenges encountered by health systems, healthcare providers, patients, and device producers in handling vulnerabilities, and how federal organizations can reinforce coordination to boost device cybersecurity.

HIPAA required the development of a unique patient identifier (UPI), however, there is no funding provided to date. The appropriations bill still prohibits financing for a national patient identifier, although a UPI could help to make sure that patients are correctly related to the proper medical records.

 

Cyber insurance policies could help pay for the expense of losses due to ransomware attacks, however, these policies are harder to lay claim to. Insurance companies are tightening up their prerequisites for getting policies and a lot of insurance companies are putting restrictions on underwriting sums. Premiums are likewise rising, making policies too expensive for a lot of healthcare providers, when insurance may even be acquired. There have been more negative news this week for healthcare companies that cannot get cyber insurance, since the Ohio Supreme Court has lately decided that ransomware attacks are not tantamount to physical damage, meaning claims against property insurance plans are not possible.

This decision concludes the 3-year court case between the insurance provider, Owners Insurance Company, and medical billing software company, EMOI. EMOI encountered a ransomware attack last September 2019 and paid the $35,000 ransom demand to recover files access to its files. EMOI additionally bought upgrades to its security facilities to stop more attacks. The ransomware group gave the data decryption keys and the majority of files were retrieved; nevertheless, the automated phone call system cannot be decrypted and needed to be replaced.

EMOI filed a claim with its property insurance plan seeking to recuperate the losses, however, the claim was declined. EMOI subsequently filed a lawsuit against Owners since the insurance policy included direct physical damage to digital files. Owners stated that the ransomware attack didn’t have a physical aspect, thus it was not covered by the insurance plan, and the policy doesn’t include losses due to ransomware.

Last November 2021, an Ohio Appellate Court decided in support of EMOI and permitted a claim against the insurance provider for dealing with EMOI in bad faith, by not completely considering the different types of damage that could happen to media like software programs; nevertheless, all seven justices of the Ohio Supreme Court took Owners’ side and released a summary judgment dropping the EMOI legal case.

EMOI had contended that computer software program is categorized under “media” that could be destroyed. Although the software program is non-physical, the insurance policy must still cover the losses even if the hardware is not damaged. The Supreme Court justices were not convinced by that point, deciding that the phrase “direct physical loss of or damage to” is to mean direct physical damage to its media.

Although the phrase “computer software” is included in the meaning of “media”, the justices decided that computer software was just included insofar as the software program is included in covered media, and that covered media indicates the media has a physical presence. Because there was no direct physical loss or physical damage to the protected media that contain the computer software, the policy does not cover the losses. Additionally, computer software can’t have a direct physical loss or physical damage since it doesn’t have a physical presence.

A summary of data breaches that were just reported to the HHS’ Office for Civil Rights and state attorneys general.

Blue Shield of California

Blue Shield of California has commenced informing selected health plan members concerning a privacy violation by one of its staff members. The employee emailed a spreadsheet comprising plan members’ names, phone numbers, Social Security numbers, addresses, email addresses, and/or Taxpayer ID numbers from his/her work account to a personal email address on June 17, 2022. Privacy Officer David Keystone of Blue Shield of California stated it discovered the privacy breach on October 30, 2022, and the staff member was assessed and advised to remove the email and any spreadsheet copy.

Because of the incident, Blue Shield of California strengthened its system detection tools to stop other impermissible disclosures of PHI. As a safety measure against identity theft, affected people were provided free one-year access to a credit monitoring and identity theft protection service.

The number of persons impacted is not yet certain.

Pediatrics West & Allergy West

Pediatrics West & Allergy West located in Massachusetts have advised 1,364 patients about the unauthorized access to their PHI that was saved on its system. The provider discovered the breach on October 17, 2022 and the forensic investigation affirmed that unauthorized access took place between August 19, 2021, and August 15, 2022. The data records on the system involved names, contact data, dates of birth, demographic data, diagnosis and treatment information, prescription details, medical record numbers, dates of service, provider names,
and/or health insurance details. Pediatrics West mentioned it has enforced extra safety measures and technical security steps to further safeguard and keep an eye on its IT infrastructure.

Medstar Mobile Healthcare

The emergency and nonemergency ambulance service of Medstar Mobile Healthcare operating in Tarrant County, TX lately publicized that it encountered a cyberattack resulting in the potential compromise of patient information. Suspicious network activity was seen on October 20, 2022, and it was eventually established that an unauthorized third party had obtained access to sections of the network that saved patient data. It cannot be determined if the files were accessed or exfiltrated. The analysis of the files indicated they largely included non-financial billing data only; nonetheless, several persons additionally had their complete name, date of birth, contact details, and limited medical details revealed. The incident investigation is continuing.

The number of affected individuals stays uncertain.

Mailing Error at The Louis A. Johnson VA Medical Center

The Louis A. Johnson Veterans’ Administration Medical Center based in West Virginia has just reported a privacy breach regarding the PHI of 736 people. There was a mistake in a mailing to veterans making the full Social Security numbers visible on the letters. Affected veterans were informed via mail and were given complimentary access to credit monitoring services. The VA has furthermore made a work group to take a look at the mailing processes to check likely vulnerabilities, and more managers will be employed to steer clear of identical difficulties down the road.

The primary care service provider, Health Specialists of Central Florida Inc. (HSCF), based in Orlando, FL paid the HHS’ Office for Civil Rights a $20,000 financial penalty to resolve a HIPAA Right of Access violation.

On November 22, 2019, OCR started an investigation after receiving a complaint from a lady who was not furnished with a copy of her departed father’s health records. The preliminary written request was submitted on August 29, 2019. She provided HSCF with an Authorization for Release of Medical Record Information form together with a photocopy of the original Letters of Administration. After several requests and about 5 months, HSCF provided all of the needed health records. The entire set of information was obtained by the lady on January 27, 2020.

As per the HIPAA Right of Access, healthcare companies must provide a copy of the requested health records within 30 days of getting the request. In particular instances, there may be a 30-day extension. OCR established that the late provision of the requested documents violated the HIPAA Right of Access. Besides having to pay a $20,000 financial penalty, HSCF decided to carry out the following corrective action plan:

creating, implementing, and sustaining HIPAA Privacy Rule guidelines and procedures regarding the HIPAA Right of Access
disseminating those guidelines and procedures to employees
giving training about those guidelines and procedures.

HSCF is going to be supervised by OCR for a two-year period starting on the day of the negotiation.

A person’s right to access their health data is one of the foundations of HIPAA, and it is taken seriously by OCR. OCR will keep on ensuring that health plans and health care providers are serious to adhere to the regulation. The report of the HHA echoes the value of accessing data and that covered entities are doing something to enforce the procedures and employees are training to make sure that they are carrying out almost all they can to assist patients’ access.

OCR started the HIPAA Right of Access enforcement in the fall of 2019. After that, healthcare providers already paid $2,423,650 to settle HIPAA Right of Access violations within 42 enforcement activities. The fines vary from $3,500 up to $240,000.

Amazon made an announcement that it is going to end support for third-party HIPAA-covered skills for its Alexa products, meaning developers won’t be able to make Alexa skills that gather information protected by the Health Insurance Portability and Accountability Act (HIPAA).

Amazon released its HIPAA-compliant Alexa function in April 2019, with skills included for patients of Boston Children’s Hospital, Atrium Health, Cigna, Livongo, Swedish Health Connect, and Express Scripts. The HIPAA compliance support is supposed to enable healthcare providers to use Alexa skills that gathered HIPAA-protected information and could send that data in a HIPAA-compliant manner. The decision to end that support is now going to take effect. HIPAA-covered skills are now included in the Alexa Smart Properties for Healthcare business devices, and those Alexa skills may only be created together with first-party support.

Amazon reviews its experiences on a regular basis to make sure it is providing services that will please its consumers. It is investing to a great extent in creating healthcare experiences together with first and third-party product developers, such as Alexa Smart Properties for Healthcare.

Amazon has already sent a letter to all third-party product developers advising them that it is ending the support for Alexa 3P HIPAA-covered skills this week and has instructed them to delete their HIPAA-covered skills from the skills store. Any skill that is not removed from the store by the developer will be deleted automatically on December 9, 2022, and the usage of that skill is going to be restricted. Any protected health information (PHI) linked to that skill will be erased and if any person tries to utilize a HIPAA-covered skill after it has been restricted, they will get a note that the skill is not supported. Amazon has stated that it is not going to directly notify users of the skills that support is stopping.

The stopping of third-party HIPAA-covered skills support doesn’t mean that Amazon is restricting all healthcare-associated Alexa skills. Just those Alexa skills that collect PHI will be restricted. Any healthcare-associated Alexa skill that does not collect information covered by HIPAA won’t be affected.

The HHS’ Office for Civil Rights has issued an announcement stating that adding third-party tracking technologies on websites, web programs, and mobile apps without signing a business associate agreement (BAA) violates HIPAA in case the tracking technology gathers and transfers individually identifiable health data. Despite having a BAA, using tracking technology could still mean HIPAA violation.

The announcement was given after discovering at the beginning of this year the extensive use of the Meta Pixel tracking code on the websites of hospitals and the transfer of data to Meta, which include sensitive patient information. An investigation by The Markup and STATT exposed these privacy breaches involving the use of Meta Pixel on the websites of a third of the top 100 U.S. hospitals. In 7 cases, the code was put in password-protected patient websites. The study was restricted to the top 100 hospitals, therefore most likely hundreds of hospitals have utilized the code and have unknowingly transmitted sensitive information to Meta/Facebook without a signed business associate agreement and without getting patient permission.

After the report was published, healthcare companies faced a number of lawsuits because of these impermissible disclosures. A number of plaintiffs said the data exposed on the healthcare providers’ websites was transmitted to Meta and was utilized to show them targeted ads associated with their health conditions. The news shocked healthcare companies, prompting investigations and the latest data breach notifications; nonetheless, even with the prevalent usage of the tracking code, only a few hospitals and health centers have submitted breach reports and have issued notifications to date. The announcement from the HHS will probably cause a number of breach notifications as companies learn that the usage of Meta Pixel and different tracking codes point to a HIPAA violation.

What are Tracking Technologies?

Tracking technologies are generally snippets of code that are put on websites, web programs, and mobile apps for monitoring user activity, typically for determining the activities of end users while utilizing websites and checking their on-site activities. The data gathered by these technologies may be reviewed and utilized to enhance the services offered by the websites and apps and improve the user experience, which is beneficial to patients. Although using this code has advantages for people because the HIPAA-covered entity gets useful information, there is a big possibility of causing harm, as the data gathered via these technologies is often sent to the vendor.

For example, when a female patient booked an appointment on a healthcare provider’s website to consult a pregnancy issue, the tracking technology on the website could transmit the information to the vendor, and eventually share it with other third parties. That data can be given to authorities or other third parties. Data shared by a person on a website or web app may be transmitted to a third party and be employed for fraudulence, identity theft, extortion, harassment, or to disseminate false information.

In a lot of instances, these tracking technologies are put on websites and apps without the users’ awareness, and it is frequently uncertain how any shared data will be utilized by a vendor and to whom it will be transmitted. Tracking technologies usually employ cookies and web beacons that enable the tracking of persons online, enabling the collection of even more data about them to create complete profiles. If tracking codes are used in web apps, they can gather device-associated data, such as demographic data which is linked to a distinct identifier for that unit to identify a user.

Tracking Technologies Should Comply With HIPAA

The HIPAA does not prohibit using tracking technologies, however, the HIPAA Rules are applicable when using third-party tracking technologies:

• in case the tracking technology gathers individually identifiable data that is covered by HIPAA if the information is transmitted to a third party, whether to the tracking technology vendor or another third-party
• in case the tracking technology gathers any identifiers, they are categorized as protected health information (PHI) since the information links the person to the regulated entity, showing the person has gotten or will get medical care services or benefits from the covered entity, and that pertains to the person’s past, present, or future health care or payment for medical care.

There is an increased possibility of an impermissible PHI disclosure when tracking code is used on patient websites or any other webpages that demand authentication since these webpages normally have PHI access. In case the tracking code is put on these pages, it should be set up in a way that ensures the code uses and discloses PHI according to the HIPAA Privacy Rule, and that any data gathered is according to the HIPAA Security Rule.  The same rule should be followed when using tracking technologies in a HIPAA-covered entity’s mobile applications when it gathers and sends PHI. OCR states that only mobile applications used by healthcare companies are under HIPAA. HIPAA is not applicable to third-party applications that individuals voluntarily download, even when the applications gather and transfer health data.

The OCR announcement states that when tracking technologies are employed, the code provider, such as Google (Google Analytics) and Meta Platforms (Meta Pixel), would be categorized as a business associate and should have a business associate agreement (BAA) signed together with the HIPAA-covered entity prior to adding the code to a web page or application. The BAA should state the vendor’s responsibilities regarding the PHI and define the allowed uses and disclosures of that data. In case the vendor does not have a signed BAA, the PHI provided to the vendor is illegal, thus the code should not be used or should be set up in a way that PHI is not collected or transmitted. OCR additionally stated that when a vendor claims that they will remove any identifiable information before keeping or utilizing the transferred information, the vendor still needs a signed BAA and only if the disclosure is permitted by the HIPAA Privacy Rule.

Other possible HIPAA violations could happen. When any PHI is shared with a vendor, it should be consistent with the company’s privacy policy and be stated in their Notice of Privacy Practices. It is not enough to merely mention the use of tracking technology in a notice of privacy practices. Aside from a BAA, any PHI disclosure of PHI for a purpose not specifically allowed by the HIPAA Privacy Rule needs authorization from a patient, stating their consent to share that data. Website banners that ask a website guest to agree to cookies and the usage of web tracking technologies is not considered valid HIPAA authorization.

Actions that HIPAA-Regulated Entities Must Undertake Right Away

HIPAA-covered entities must read the bulletin very carefully to ensure they fully grasp the application of HIPAA to tracking technologies. They must additionally perform an evaluation of any tracking technologies that they add on their web pages, web programs, or mobile applications to make sure the use of the technologies is HIPAA compliant. When they are not yet evaluated, website tracking technologies should be added to a HIPAA-covered entity’s risk evaluation and risk management procedures.

It is essential to mention that a tracking technology vendor is categorized as a business associate as per HIPAA, even when there’s no BAA. Consequently, any disclosures to that vendor are categorized as impermissible PHI disclosure when there’s no BAA in place. The HIPAA-covered entity may be issued fines and other sanctions when PHI is sent with no signed BAA.

In case the review indicated that a HIPAA-regulated entity used tracking technologies in a HIPAA non-compliant way now or in the past, the HIPAA Breach Notification Rule is applicable. The entity must send notifications to OCR and those who had their PHI impermissibly disclosed.

CommonSpirit Health has updated its October 2022 ransomware attack and affirmed that the threat actors responsible for the attack viewed files that contain patient data.

CommonSpirit Health detected the attack on October 2, 2022, and took immediate action to protect its network. The attack disrupted its healthcare services because systems were taken off the internet to limit the impact of the incident. Nevertheless, the incident did not affect patient care, clinic, and associated systems at Virginia Mason Medical Center, Dignity Health, Centura Health and TriHealth facilities. The forensic investigation affirmed that the threat actors accessed its network from September 16, 2022, to October 3, 2022.

CommonSpirit Health has already confirmed that the threat actors acquired access to sections of its network that contain files with the protected health information (PHI) of patients from Franciscan Medical Group and Franciscan Health located in Washington state. Patients that received healthcare services from these hospitals were also affected:

• St. Anne Hospital (previously Highline Hospital)
• St. Michael Medical Center (previously Harrison Hospital)
• St. Anthony Hospital
• St. Elizabeth Hospital
• St. Clare Hospital
• St. Joseph Hospital
• St. Francis Hospital

Those facilities are currently recognized collectively as Virginia Mason Franciscan Health, which is CommonSpirit Health’s affiliate.

ComnmonSpirit Health has stated that the impacted files included the following data of patients along with their loved ones and caregivers: names, telephone numbers, dates of birth, addresses, and unique internal patient identifiers. To date, there is no proof found that indicates attempted or actual misuse of the information kept on its systems.

CommonSpirit Health stated most of the EHRs throughout the CommonSpirit Health system and patient portals are already accessible online. The analysis of impacted files is still in progress and the number of affected individuals is not yet confirmed. CommonSpirit Health has advised patients to review their account statements for correctness and to report any services or transactions that were not charged to their healthcare provider or insurance company.