Lexology February 20, 2024
McGuireWoods LLP

On Feb. 6, 2024, the U.S. Department of Health and Human Services’ Office for Civil Rights (OCR) announced a $4.75 million settlement with New York nonprofit health system Montefiore Medical Center over alleged malicious insider conduct that caused potential violations of the Health Insurance Portability and Accountability Act (HIPAA) Security Rule. This settlement follows two other recent investigations that led to OCR’s first-ever settlements stemming from ransomware and phishing attacks.

Covered entities and business associates subject to the HIPAA Security Rule should be aware that OCR may hold them accountable for breaches not only from outside the walls of the organization, but also from within.

The Reported Conduct and Settlement

Montefiore reported in 2015 that two years prior, a Montefiore...

Today's Sponsors


Today's Sponsor


Topics: Cybersecurity, Govt Agencies, Health IT, Health System / Hospital, HIPAA, Provider, Technology
50 things to know about HCA, Tenet, CHS and UHS
How Mercy accelerated rare disease diagnoses in rural areas
Private equity-backed radiology provider Solis Mammography inks joint venture deal with large hospital system
Why health system AI predictions can fail
HCA Midwest opens $9.3M Missouri ASC

Share This Article