BizTech Law Blog Banner

BizTech Law Blog

HHS Office for Civil Rights Publishes Checklist for HIPAA Covered Entities Responding to Cybersecurity Incidents
Posted by:

The U.S. Department of Health and Human Service's Office for Civil Rights ("OCR") recently published guidance for entities covered by HIPAA, entitled "My entity just experienced a cyber-attack! What do we do now?"

The checklist-style guidance is designed to briefly explain the steps that HIPAA covered entities should take in response to a cyber attack or other cybersecurity incident. This effort is likely a response to both the general increase in cyber crime targeting healthcare entities, and specifically, the ransomware attack that prevented numerous UK hospitals from caring for patients.

According to OCR, HIPAA covered entities should take the following steps in response to a cyber attack or other cybersecurity incident:

  • Execute the planned response and mitigation procedures and contingency plans.
  • Report the crime to law enforcement agencies.
  • Report all cyber threat indicators to federal and information-sharing and analysis organizations ("ISAOs").
  • Report a breach to OCR as soon as possible, but not later than 60 days after the discovery of a breach affecting 500 or more individuals and notify affected individuals and the media unless a law enforcement official has requested a reporting delay.

HIPAA covered entities should review the checklist for additional information and ensure compliance with relevant rules. OCR may impose a civil money penalty after investigating an entity that has experienced a breach, but the HIPAA Enforcement Rule allows OCR to consider mitigating factors when setting the amount of the penalty.

Authors

Categories

Recent Posts

Jump to Page

Foster Swift Collins & Smith PC Cookie Preference Center

Your Privacy

When you visit our website, we use cookies on your browser to collect information. The information collected might relate to you, your preferences, or your device, and is mostly used to make the site work as you expect it to and to provide a more personalized web experience. For more information about how we use Cookies, please see our Privacy Policy.

Strictly Necessary Cookies

Always Active

Necessary cookies enable core functionality such as security, network management, and accessibility. These cookies may only be disabled by changing your browser settings, but this may affect how the website functions.

Functional Cookies

Always Active

Some functions of the site require remembering user choices, for example your cookie preference, or keyword search highlighting. These do not store any personal information.

Form Submissions

Always Active

When submitting your data, for example on a contact form or event registration, a cookie might be used to monitor the state of your submission across pages.

Performance Cookies

Performance cookies help us improve our website by collecting and reporting information on its usage. We access and process information from these cookies at an aggregate level.

Powered by Firmseek