Ransomware Resources for HIPAA Regulated Entities

Ransomware Resources for HIPAA Regulated Entities

The HHS Office for Civil Rights (OCR) is sharing the following information to ensure that HIPAA regulated entities are aware of the resources available to assist in preventing, detecting, and mitigating breaches of unsecured protected health information caused by hacking and ransomware.

HHS Health Sector Cybersecurity Coordination Center Threat Briefs

Sector and Threat Briefs

• • January 28, 2021 - ATTACK for Emotet
  • March 12, 2021 - New Ryuk Variant Analyst Note
  • April 8, 2021 - Ryuk Variants
  • May 25, 2021 - Conti Ransomware Analyst Note
  • June 3, 2021 - Ransomware Trends 2021
  • July 8, 2021 - Conti Ransomware
  • July 8, 2021 - Phobos Ransomware Analyst Note
  • August 5, 2021 - Qbot/QakBot Ransomware
  • August 6, 2021 - Lazio Ransomware Attack Analyst Note
  • August 19, 2021 - REvil Update
  • August 24, 2021 - OnePercent Group Ransomware Alert
  • August 25, 2021 - IOCs Associated with Hive Ransomware Alert
  • September 2, 2021 - Demystifying BlackMatter

HHS Resources on Section 405(d) of the Cybersecurity Act of 2015

• Health Industry Cybersecurity Practices: Managing Threats and Protecting Patients
• Cybersecurity Reports and Tools

OCR Guidance

• Ransomware
• Cybersecurity
• Risk Analysis

HHS Security Risk Assessment Tool

• Assessment Tool

CISA Protecting Sensitive and Personal Information from Ransomware-Caused Data Breaches

• Stop Ransomware
• Protecting Personal and Sensitive Information

CISA Ransomware Guide

• Ransomware Guide

FBI Resources

• Common Scams and Crimes 
• FBI PSA

OCR Cybersecurity Newsletters

• Making a List and Checking it Twice: HIPAA and IT Asset Inventories (Summer 2020 Cybersecurity newsletter) 
• What Happened to My Data?: Update on Preventing, Mitigating and Responding to Ransomware (Fall 2019 Cybersecurity Newsletter)
• Phishing (February 2018 Cybersecurity Newsletter)
• Plan A… B… Contingency Plan! (March 2018 Cybersecurity Newsletter)
• Cybersecurity Incidents will happen… Remember to Plan, Respond, and Report! (May 2017 Cybersecurity newsletter)

Reminder

A ransomware attack may result in a breach of unsecured protected health information that triggers reporting requirements under the HIPAA Breach Notification Rule.  HIPAA covered entities and business associates should review OCR’s ransomware guidance for information regarding potential breach notification obligations following a ransomware attack.

About the Author

Reed Tinsley CPA

This article is written by Reed Tinsley, a Houston, TX-based CPA with over 30 years of experience advising physicians and medical practices across Texas and the United States. Reed holds certifications as a Certified Valuation Analyst (CVA), Certified Healthcare Business Consultant (CHBC), and Certified Financial Planner (CFP), specializing exclusively in the healthcare sector. He is a published author, nationally recognized speaker, and trusted advisor to physicians on accounting & tax, practice management, and financial planning. Schedule a Free Consultation.