Recent Cybersecurity Incident Prompts HIPAA Compliance Review

1.5 minute read

The recent cybersecurity incident affecting Change Healthcare, a unit of UnitedHealth Group, has prompted the U.S. Department of Health and Human Services (HHS) to take action. Due to the significant impact of this cyberattack, HHS' Office for Civil Rights (OCR) is conducting an investigation to determine whether these entities complied with the HIPAA Privacy, Security, and Breach Notification Rules. This includes assessing whether any protected health information (PHI) was compromised.

OCR is encouraging HIPAA-covered entities (health plans, health insurance issuers, and health care providers) and their associates to promptly review their cybersecurity measures “with urgency” to ensure that health information is protected. Employers using third-party vendors like third-party administrators (TPAs) and pharmacy benefit managers (PBMs), should verify their cybersecurity measures and ensure secure business associate agreements for electronic PHI.

Health Care Cyberattacks

On Feb. 21, 2024, Change Healthcare, a major health insurance platform in the U.S., was hit by a significant cyberattack, impacting millions of providers and patients nationwide. The incident, labeled one of the most disruptive attacks in history by cybersecurity experts, highlights the growing threat of ransomware and hacking in healthcare. In the past five years, there has been a 256% increase in hacking-related breaches reported to OCR, with hacking accounting for 79% of large breaches in 2023.

Compliance Resources

To help covered entities and business associates safeguard PHI and protect their systems from cyberattacks, the OCR has provided some helpful tools and resources.

• HIPAA Security Rule Guidance Material
• OCR VIDEO – How the HIPAA Security Rule Protects Against Cyberattacks
• OCR Webinar on HIPAA Security Rule Risk Analysis Requirement
• HIPAA Security Risk Assessment Tool
• Fact Sheet: Ransomware and HIPAA

Download the bulletin for more details.