At the end of last year the Department of Health and Human Services – Office for Civil Rights announced its resolution agreement and settlement with 21st Century Oncology for $2.3 million. The company, which billed itself as the largest operator of cancer treatment centers in the world, filed for bankruptcy in May of 2017. OCR’s press release of the breach settlement stated that 21st Century Oncology was twice notified by the FBI in 2015 that patient information had been illegally obtained and was being sold. Following notice, the company determined through an internal investigation that the attacker may have accessed its network SQL database through the remote desktop protocol in early October of 2015 and that 2,213,597 individuals were potentially impacted. Information accessed included names, dates of birth, social security numbers, physicians’ names, diagnoses, treatments, and insurance information.
OCR’s subsequent investigation revealed that the company failed to conduct a thorough security risk assessment; failed to implement appropriate security measures; failed to implement audit logs, access reports, or security incident tracking reports to track system activity; and disclosed protected health information to third party vendors without a written business associate agreement. In addition to the monetary settlement, the company must “complete a risk analysis and risk management plan, revise policies and procedures, educate its workforce on policies and procedures, provide all maintained business associate agreements to OCR, and submit an internal monitoring plan.”
This joins ten other resolution agreements published by OCR in 2017, totaling $19,393,000 in monetary settlements. The healthcare industry continues to be a lucrative target for security breaches, despite increased awareness around cybersecurity. We expect healthcare breaches taking a top spot in breaches this year.
Putting It Into Practice: The settlements from 2017 are a reminder to the health care industry to remain prepared. “An ounce of prevention is worth a pound of cure:” we anticipate that OCR will continue to penalize those organizations that do not implement reasonable privacy and security policies and procedures and continually assess their security risks.