Pulse November 10, 2023
On Halloween 2023, the Office for Civil Rights dropped news of what could be seen as a treat to OCR, but a trick on the impacted entity. The announcement was the most recent settlement of a HIPAA issue, which was another ransomware based incident. As always, it is helpful to summarize the situation and then see what lessons might be drawn from the circumstances.
The Factual Setup
The settlement was between OCR and Doctors’ Management Services (“DMS”). DMS is a business associate as it provides practice management support and solutions for practices. OCR initiated its investigation into DMS after the voluntary and compliant submission of a data breach notice by DMS on April 22, 2019. In its notice to OCR,...