{ Banner Image }

HHS Office for Civil Rights Publishes Checklist for HIPAA Covered Entities Responding to Cybersecurity Incidents

The U.S. Department of Health and Human Service's Office for Civil Rights ("OCR") recently published guidance for entities covered by HIPAA, entitled "My entity just experienced a cyber-attack! What do we do now?"

The checklist-style guidance is designed to briefly explain the steps that HIPAA covered entities should take in response to a cyber attack or other cybersecurity incident. This effort is likely a response to both the general increase in cyber crime targeting healthcare entities, and specifically, the ransomware attack that prevented numerous UK hospitals from caring for patients.

According to OCR, HIPAA covered entities should take the following steps in response to a cyber attack or other cybersecurity incident:

  • Execute the planned response and mitigation procedures and contingency plans.
  • Report the crime to law enforcement agencies.
  • Report all cyber threat indicators to federal and information-sharing and analysis organizations ("ISAOs").
  • Report a breach to OCR as soon as possible, but not later than 60 days after the discovery of a breach affecting 500 or more individuals and notify affected individuals and the media unless a law enforcement official has requested a reporting delay.

HIPAA covered entities should review the checklist for additional information and ensure compliance with relevant rules. OCR may impose a civil money penalty after investigating an entity that has experienced a breach, but the HIPAA Enforcement Rule allows OCR to consider mitigating factors when setting the amount of the penalty.

Categories: Cybersecurity, Digital Assets, Electronic Health Records, Fraud & Abuse, HIPAA

Photo of Taylor A. Gast

Taylor helps businesses and business owners solve and prevent problems as a member of Foster Swift's Business and Tax practice group. He handles business formation and transactions, tax controversies, employee benefits, and technology related issues.

View All Posts by Author ›

Type the following characters: foxtrot, romeo, niner, six

* Indicates a required field.

Subscribe to RSS»
Get Updates By Email:

Best Lawyers® 2021

Congratulations to the attorneys of the Health Care practice group at Foster Swift Collins & Smith, PC for their inclusion in the Best Lawyers in America 2021 edition. Firm-wide, 44 lawyers were listed. Best Lawyers lists are compiled based on an exhaustive peer-review evaluation and as lawyers are not required or allowed to pay a fee to be listed; inclusion in Best Lawyers is considered a singular honor. Health Care practice group members listed in Best Lawyers are as follows:

To see the full list of Foster Swift attorneys listed in Best Lawyers 2021, click here.