Lexology February 20, 2024
On Feb. 6, 2024, the U.S. Department of Health and Human Services’ Office for Civil Rights (OCR) announced a $4.75 million settlement with New York nonprofit health system Montefiore Medical Center over alleged malicious insider conduct that caused potential violations of the Health Insurance Portability and Accountability Act (HIPAA) Security Rule. This settlement follows two other recent investigations that led to OCR’s first-ever settlements stemming from ransomware and phishing attacks.
Covered entities and business associates subject to the HIPAA Security Rule should be aware that OCR may hold them accountable for breaches not only from outside the walls of the organization, but also from within.
The Reported Conduct and Settlement
Montefiore reported in 2015 that two years prior, a Montefiore...
Today's Sponsors
Today's Sponsor