Federal Sentencing Guidelines |

OCR Nails Second HIPAA Covered For Allowing Ransomware Breach

February 23, 2024

Health care providers, health plans, health care clearinghouses and their business associates (covered entities) that fail to appropriately safeguard their protected health information and systems against randomware and other malware threats as required by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) should expect to pay hefty amounts to the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) if an attack occurs. That is the clear message sent by OCR’s February 22, 2022 announcement of its second ransomware settlement since October, 2023.

Duty To Guard Against Malware

OCR enforces the HIPAA Privacy, Security, and Breach Notification Rules, which sets forth the requirements that HIPAA covered entities (most health care providers, health plans, and health care clearinghouses) and their business associates must follow to protect the privacy and security of protected health information.

Ransomware and hacking are the primary cyber-threats in health care. A type of malware (malicious software) designed to deny access to a user’s data, usually by encrypting the data with a key known only to the hacker who deployed the malware, until a ransom is paid, OCR has seen large breaches affecting more than 500 individuals reported to OCR involving hacking increase 256% and those from ransomware increase 264% increase over the past five years,

In 2023, hacking accounted for 79% of the large breaches reported to OCR. The large breaches reported in 2023 affected over 134 million individuals, a 141% increase from 2022.

In light of the growing threat, OCR is prioritizing enforcement, education and compliance outreach to HIPAA covered entities.

OCR’s February 22, 2024 announcement of its second ever and second settlement of a malware related enforcement action in less than five months demonstrates OCR’s readiness to hold covered entities accountable for failing to fulfill this responsibility.

Green Ridge Ransomeware Breach

OCR’s February 22, 2022 announcement of its second ever ransomware related resolution agreement and corrective action plan reaffirms OCR’s readiness to hold covered entities accountable for failing to guard against ransomware and other cyber risks.

Green Ridge Behavioral Health, LLC, (Green Ridge), a Maryland-based practice that provides psychiatric evaluations, medication management, and psychotherapy. This marks the second settlement that OCR has reached with a HIPAA regulated entity for potential violations identified during an investigation following a ransomware attack.

The settlement resolves an investigation following a ransomware attack that affected the protected health information of more than 14,000 individuals.

OCR learned of the breach after Green Ridge filed a breach report with OCR in February 2019 that stated that its network server had been infected with ransomware resulting in the encryption of company files and the electronic health records of all patients.

In keeping with its policy of investigating all breaches affecting more that 500 individuals (large breaches), OCR opened an investigation in April, 2019.

OCR’s investigation of the breach found evidence of potential violations of the HIPAA Privacy and Security Rules leading up to and at the time of the breach. Other findings included that Green Ridge Behavioral Health failed to:

Have in place an accurate and through analysis to determine the potential risks and vulnerabilities to electronic protected health information;
Implement security measures to reduce risks and vulnerabilities to a reasonable and appropriate level; and
Have sufficient monitoring of its health information systems’ activity to protect against a cyber-attack.

Under the terms of the settlement, Green Ridge agreed to pay $40,000 and implement a corrective action plan that will be monitored by OCR for three years to avoid exposure to potentially much greater HIPAA monetary penalties.

The plan also requires Green Ridge to take many actions to resolve potential HIPAA violations and to protect electronic protected health information, including:

Conducting a comprehensive and thorough analysis of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information;
Designing a Risk Management Plan to address and mitigate security risks and vulnerabilities found in the Risk Analysis;
Reviewing, and as necessary, developing, or revising its written policies and procedures to comply with the HIPAA Rules;
Providing workforce training on HIPAA policies and procedures;
Conducting an audit of all third-party arrangements to ensure appropriate business associate agreements are in place, where applicable; and
Reporting to OCR when workforce members fail to comply with HIPAA.

First Malware Settlement

Prior to this week’s announcement of the Green Ridge resolution agreement, OCR already had announced its first ever malware related resolution agreement on October 31, 2023.

That $100,000 settlement resolved a potentially much greater HIPAA liability business associate Doctors’ Management Services (DMS) could have faced for alleged HIPAA violations OCR found investigating a large breach report DMS filed on April 22, 2019.

The DMS breach report disclosed that a ransomware attack affected DMS’ network server with GandCrab ransomware beginning with an initial unauthorized access to the network that occurred on April 1, 2017; however, DMS did not detect the intrusion until December 24, 2018, Once the DNS system was accessed, ransomware was used to encrypt their files. The attack affected the electronic protected health information of 206,695 individuals

OCR’s investigation of the DNS breach found evidence of potential failures by DMS to have in place an analysis to determine the potential risks and vulnerabilities to electronic protected health information across the organization. Other findings included insufficient monitoring of its health information systems’ activity to protect against a cyber-attack, and a lack of policies and procedures in place to implement the requirements of the HIPAA Security Rule to protect the confidentiality, integrity, and availability of electronic protected health information.

Under the terms of the DMS settlement agreement paid $100,000 to OCR and agreed to implement a corrective action plan that requires:

DMS to submit to OCR monitoring for three years to ensure compliance with HIPAA
Review and update its Risk Analysis to identify the potential risks and vulnerabilities to Doctor’s Management Services data to protect the confidentiality, integrity, and availability of electronic protected health information.
Update its enterprise-wide Risk Management Plan (strategy to protect the confidentiality, integrity, and availability of ePHI) to address and mitigate any security risks and vulnerabilities found in the updated Risk Analysis.
Review and revise, if necessary, its written policies and procedures to comply with the Privacy and Security Rules.
Provide workforce training on HIPAA policies and procedures.

Warning To All Covered Entities

Along with announcing the two recent resolution agreements, OCR also is warning all covered entities to tighten their malware and ransomware safeguards.

OCR’s announcement of the Green Ridge resolution agreement, for instance, quotes OCR Director Melanie Fontes Rainer as stating, “Health care providers need to understand the seriousness of these attacks and must have practices in place to ensure patients’ protected health information is not subjected to cyber-attacks such as ransomware.”

To assist covered entities to meet this responsibility, OCR has developed Fact Sheet guidance that recommends covered entities to take at least the following steps to guard against breaches from ransomware and other malware attacks:

Review all vendor and contractor relationships to ensure business associate agreements are in place as appropriate and address breach/security incident obligations.
Risk analysis and risk management should be integrated into business processes; conducted regularly and when new technologies and business operations are planned.
Ensure audit controls are in place to record and examine information system activity.
Implement regular review of information system activity.
Utilize multi-factor authentication to ensure only authorized users are accessing ePHI.
Encrypt ePHI to guard against unauthorized access to ePHI.
Incorporate lessons learned from incidents into the overall security management process.
Provide training specific to organization and job responsibilities and on regular basis; reinforce workforce members’ critical role in protecting privacy and security.
two recent resolutions agreements and other guidance and enforcement actions make clear that all covered entities should ensure their ability to demonstrate their completion of these and other actions a risk analysis shows are needed to defend against a ransomware or other malware threats. This guidance also alerts covered entities to stay vigilant and update risk assessments and safeguards in response as to evolving threats.

Covered entities should not assume the relatively modest settlement amounts collected in the two new ransomware settlements compared to exponentially greater resolution settlements like the $4.75 million settlement payment New York based Montefiore Medical Center made last year reflect greater tolerance for ransomware related threats versus internal or external hacking. To the contrary, the Montefiore Medical Center resolution makes clear the randomware threat is one of a multitude of internal and external threats covered entities must defend their protected health information against to comply with HIPAA.

Moreover, covered entities and their leaders also should take steps to understand and fully address all other statutory, ethical, contractual or other privacy or confidentiality requirements beyond those imposed by HIPAA. For example, health care providers, health plans and their fiduciaries, brokers, administrators and insurers also may bear responsibilities under the Employee Retirement Income Security Act fiduciary responsibility rules, the Fair and Accurate Credit Transactions Act, federal and state electronic crimes, privacy data security, artificial intelligence, workforce, tax, and other laws.

Publicly traded organizations and their leaders also may face responsibilities and liability under new Securities and Exchange Commission regulations, clawback rules and other laws arising from the occurrence or bungled response to a breach.

Likewise, got businesses sponsoring or administering employment-based health plans, Employee Benefit Security Administration considers managing cybersecurity risks a part of the fiduciary obligations of fiduciaries of employment-based health plans. Meanwhile, health care providers, insurance organizations and brokers, third party administrators, government contractors, attorneys and other advisors and others also may be subject to medical confidentiality and other data privacy and security obligations under federal and state electronic crimes, identity theft, ethics, professional licensure, contractual, common law privacy and other statutory and common laws. Since HIPAA and many of these other laws involve potential criminal as well as civil liability, organizations and leaders in covered entities generally should ensure their HIPAA and other cybersecurity compliance efforts are included in and administered according to their Federal Sentencing Guidelines Compliance program.

While it commonly is necessary or advisable to involve consulting or other technical support in the conduct of these activities, HIPAA entities should keep in mind the likelihood that their analysis and review is likely to uncover and prompt discussion of potentially legally or politically sensitive information. For this reason, HIPAA entities and their leaders generally will want to engage experienced legal counsel for assistance in structuring and executing these activities to maximize their ability to claim attorney-client privilege or other evidentiary protections against discovery or disclosure of certain aspects of these activities.

In planning for an implementing these procedures, Covered Entities also are reminded that the effectiveness of these efforts requires that the Covered Entities incorporate appropriate processes and policies for monitoring and investigating compliance with the policies and procedures implemented to comply with HIPAA. Conducting this monitoring and investigation by necessity is likely to involve surveillance, investigation and cooperation of employees, contractors, vendors and others for which Fair Credit Reporting Act background check notification and consent and other procedures are necessary or advisable.

Finally, HIPAA entities should keep in mind that HIPAA and other cybersecurity compliance and risk management is an ongoing process requiring constant awareness and diligence. Consequently, HIPAA entities should both monitor OCR and other regulatory and enforcement developments as well as exercise ongoing vigilance to monitor and maintain compliance within their organizations.

For More Informational

We hope this update is helpful. For more information about these or other health or other legal, management or public policy developments, please contact the author Cynthia Marcotte Stamer via e-mail or via telephone at (214) 452 -8297.

Solutions Law Press, Inc. invites you to receive future updates by registering on our Solutions Law Press, Inc. Website and participating and contributing to the discussions in our Solutions Law Press, Inc. LinkedIn SLP Health Care Risk Management & Operations Group, HR & Benefits Update Compliance Group, and/or Coalition for Responsible Health Care Policy.

About the Author

A Fellow in the American College of Employee Benefit Counsel, Co-Chair of the American Bar Association (“ABA”) International Section Life Sciences and Health Committee and Vice-Chair Elect of its International Employment Law Committee, Chair-Elect of the ABA TIPS Section Medicine & Law Committee, Past Chair of the ABA Managed Care & Insurance Interest Group, Scribe for the ABA JCEB Annual Agency Meeting with HHS-OCR, past chair of the ABA RPTE Employee Benefits & Other Compensation Group and current co-Chair of its Welfare Benefit Committee, and Chair of the ABA Intellectual Property Section Law Practice Management Committee, Ms. Stamer is most widely recognized for her decades of pragmatic, leading-edge work, scholarship and thought leadership on healthcare and life science, managed care and insurance and other workforce and staffing, employee benefits, safety, contracting, quality assurance, compliance and risk management, and other legal, public policy and operational concerns in the healthcare and life sciences, employee benefits, managed care and insurance, technology and other related industries. She speaks and publishes extensively on these and other related compliance issues.

Ms. Stamer’s work throughout her career has focused heavily on working with health care and managed care, life sciences, health and other employee benefit plan, insurance and financial services and other public and private organizations and their technology, data, and other service providers and advisors domestically and internationally with legal and operational compliance and risk management, performance and workforce management, regulatory and public policy and other legal and operational concerns. Scribe for the ABA JCEB Annual Meeting with the HHS Office of Civil Rights, her experience includes extensive involvement throughout her career in advising health care and life sciences and other clients about preventing, investigating and defending EEOC, DOJ, OFCCP and other Civil Rights Act, Section 1557 and other HHS, HUD, banking, and other federal and state discrimination investigations, audits, lawsuits and other enforcement actions as well as advocacy before Congress and regulators regarding federal and state equal opportunity, equity and other laws.

For more information about Ms. Stamer or her health industry and other experience and involvements, see www.cynthiastamer.com or contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here.

About Solutions Law Press, Inc.™

Solutions Law Press, Inc.™ provides human resources and employee benefit and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education on leadership, governance, human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also be interested in reviewing some of our other Solutions Law Press, Inc.™ resources available here such as:

IMPORTANT NOTICE ABOUT THIS COMMUNICATION

NOTICE: These statements and materials are for general informational and educational purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation in light of the specific facts and circumstances presented in their unique circumstances at any particular time. No comment or statement in this publication is to be construed as legal advice or an admission. The author and Solutions Law Press, Inc.™ reserve the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law is rapidly evolving and rapidly evolving rules make it highly likely that subsequent developments could impact the currency and completeness of this discussion. The author and Solutions Law Press, Inc.™ disclaim, and have no responsibility to provide any update or otherwise notify anyone of any such change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication. Readers acknowledge and agree to the conditions of this Notice as a condition of their access to this publication.

Circular 230 Compliance. The following disclaimer is included to ensure that we comply with U.S. Treasury Department Regulations. Any statements contained herein are not intended or written by the writer to be used, and nothing contained herein can be used by you or any other person, for the purpose of (1) avoiding penalties that may be imposed under federal tax law, or (2) promoting, marketing or recommending to another party any tax-related transaction or matter addressed herein.

Leave a Comment » | business associate, data breach, data security, Doctor, Electronic Health Records, Electronic Medical Records, Employer, Federal Health Center, Federal Sentencing Guidelines, Fiduciary Responsibility, Genetic Information, GINA, Health Care, Health Care Finance, Health Care Provider, Health Insurance, Health IT, Health Plan, Health Plans, healthcare, HHS, HIPAA, HIPAA Cyber Crime, HITECH Act, Home Health, home health, Hospice, Hospital, hospitals, long-term care, Medical Privacy, Medical Records, NIST, nursing home, occupational health, OCR, Pharmacy, Physician, primary care, Self-Insured Group health Plans, Telemedicine | Tagged: Breach Notification, Data Breach, Data Security, Federal Sentencing Guidelines, Health Care, Health Care Compliance, Health Care Provider, Health Plans, Health Policy, HHS, HIPAA, Hospital, Hospitals, Medical Privacy, OCR, pharmacy, PHI, Physician, Privacy, Security | Permalink
Posted by Cynthia Marcotte Stamer

“Rock Doc” Opioid Conviction Reaffirms DOJ Prioritization & Frequent Success of Illegal Opioid Distribution Enforcement

April 4, 2023

A Jackson, Tennessee nurse practitioner known in his community as the “Rock Doc” faces potentially decades of imprisonment following his federal conviction of for illegally prescribing oxycodone, fentanyl and other opioids in a “party-like atmosphere” from his medical practice by a federal jury last week. The conviction highlights the success the Justice Department continues to achieve in its efforts to investigate and prosecute health care and other individuals involved in the illegal distribution of opioids and other controlled substances.

Rock Doc Conviction

The prosecution and conviction of “Rock Doc” Jeffrery Young arose from an investigation conducted by the Department of Justice lead Appalachian Regional Prescription Opioid (ARPO) Strike Force. Based on evidence developed from the joint investigation, the Justice Department charged nurse practitioner Jeffrey Young with using his medical practice, Preventagenix, to illegally prescribe more than one million medically unnecessary controlled substance pills to hundreds of patients, including a pregnant woman and women with whom he was having inappropriate physical relationships. According to court documents, Young maintained a party-like atmosphere at his clinic, and prescribed these drugs at least in part to boost his popularity on social media and promote a self-produced reality TV show pilot based on his self-identified persona, the “Rock Doc.”

After hearing the evidence presented at trial, the federal jury convicted Young of conspiracy to unlawfully distribute controlled substances, maintaining a drug-involved premises, and 13 counts of distributing controlled substances, six of which involved distribution to a pregnant woman.

Scheduled to be sentenced in federal district court on August 3, 2023, Young faces a maximum penalty of 40 years in prison for each count involving distribution to a pregnant woman and 20 years in prison for each of the other counts of conviction. A federal district court judge will decide his actual sentence after considering the U.S. Sentencing Guidelines and other statutory factors.

While Rock Doc’s self-promotional activities may have helped draw attention to his activities, the Justice Department’s opioid enforcement priorities extend beyond media-seeking promoters. In fact, Young’s prosecution and conviction are only one of a multitude of federal prosecutions and convictions achieved by the ARPO since its inception in late 2018 as part of a nationwide fraud and opioid enforcement initiative sponsored by the Justice Department, ARPO has partnered with federal and state law enforcement agencies and U.S. Attorneys’ Offices throughout Alabama, Kentucky, Ohio, Virginia, Tennessee, and West Virginia to prosecute medical professionals and others involved in the illegal prescription and distribution of opioids. Over the past four years, ARPO has charged over 115 defendants, collectively responsible for issuing prescriptions for over 115 million controlled substance dosage units. To date, more than 70 ARPO defendants have been convicted.

DOJ’s Zealous Opioid Enforcement Priorities

Based on the success of the ARPO efforts, the Justice Department Criminal Division announced the formation of the New England Prescription Opioid (NEPO) Strike Force, a joint law enforcement effort to identify and investigate health care fraud schemes in the New England region and to effectively and efficiently prosecute individuals involved in the illegal distribution of prescription opioids and other prescribed controlled substances by partnering with federal and state law enforcement agencies in that region along the lines achieved in the ARPO. The Justice Department’s aggressive efforts to investigate and prosecute the illegal distribution of opioids and other controlled substances in these regions and across the country have produced a multitude of other federal and state indictments, prosecutions and convictions for illegal distribution of controlled substances and health care fraud. Justice Department enforcement reports confirm it is continuing to make the illegal prescription and distribution of opioids and other controlled substances a priority in 2023. See, e.g., Pharmacist Convicted for $1M Prescription Drug Fraud (February 9, 2023); Nine Arrested for Illegally Distributing 1.5 Million Opioid Pills (February 2, 2023); Doctor Sentenced for Role in Illegally Distributing 6.6 Million Opioid Pills and Submitting $250 Million in False Billings (January 30, 2023); Former Doctor Convicted of Illegal Distribution of Controlled Substances (January 11, 2023).

An example of these additional enforcement actions is the February 2023 arrest of nine individuals in Houston, Texas on charges relating to their alleged involvement in the unlawful distribution of 1.5 million opioid pills and other controlled substances by operating pill mill pharmacies as fronts to obtain opioids in their highest-strength and immediate-release pill form, then allegedly selling the drugs on the black market without the involvement of patients, prescriptions, or doctors to drug traffickers. The Justice Department also charges Lyons and Turner allegedly concealed the drug proceeds using numerous bank accounts and real estate transactions and that Lyons used some of the proceeds to purchase luxury items, including a Rolls Royce, a Ford F-250, and a Mercedes Maybach.

Meanwhile, court documents also claim that starting around December 2020, Dwain Ross and Delores Mackey-Ross, along with licensed pharmacist Ann Nguyen allegedly used pharmacies to illegally distribute and dispense nearly half a million pills of oxycodone and hydrocodone. The Justice Department alleges Dwain Ross and Mackey-Ross, along with David Ross, Kevin Peterson, and Eleanor Marsh also allegedly illegally ordered the opioid potentiators alprazolam, carisoprodol, promethazine with codeine – which are reported to enhance the high from opioids – from a pharmaceutical wholesaler and a pharmaceutical sales representative then allegedly illegally distributed the opioid potentiators in bulk. The Justice Department alleges Dwain Ross and Mackey-Ross also used numerous bank accounts and real estate transactions to conceal their ill-gotten gains and that Dwain Ross used some of the drug proceeds to purchase a Lamborghini.

The pharmacies alleged in the indictments to have been controlled by the defendants’ drug trafficking organizations are K Med Pharmacy, Nex Gen Pharmacy, TX United Pharmacy, Power Center Pharmacy #2, DR Pharmacy, and Nu Care Pharmacy. Several other pharmacies, including P&A Pharmacy and Pearland Holistic Pharmacy, voluntarily surrendered their DEA Registration numbers, which a pharmacy needs to legally purchase pharmaceutical opioids and other controlled substances.

Lyons, Turner, Alfred, Dwain Ross, Mackey-Ross, and Nguyen are each charged with illegal distribution of Schedule II opioids. Dwain Ross, Mackey-Ross, David Ross, Peterson, and Marsh are each charged with the illegal distribution of Schedule IV drugs. Lyons, Turner, Dwain Ross, and Mackey-Ross are also charged with money laundering crimes. If convicted, Lyons, Turner, Alfred, Dwain Ross, Mackey-Ross, and Nguyen face up to 20 years on the top counts. David Ross and Peterson each face up to five years. Marsh faces up to 10 years if convicted. Court documents allege that over 15 bank accounts, four real properties, and several luxury vehicles – including a Rolls Royce, a Bentley, and a Lamborghini – were involved in, or acquired with proceeds from, the scheme, and are subject to forfeiture if the defendants are convicted. A federal district court judge will determine any sentence after considering the U.S. Sentencing Guidelines and other statutory factors.

Together, the Young prosecution and conviction and other Justice Department enforcement actions send a clear warning against engaging in the illegal distribution of opioids and other controlled substances. Given these priorities and their success, all pharmacies and health care organizations should use care to maintain and administer carefully appropriate controlled substance controls to mitigate their risk of liability for potential abuses within their organization that could trigger Federal Sentencing Guideline or other organizational or individual liability.

More Information