Skip to main content


U.S. flag
      An official website of the United States government
              Here’s how you know
        Here’s how you knowDot gov**Official websites use .gov**
                 A **.gov** website belongs to an official government organization in the United States.
                  HTTPS**Secure .gov websites use HTTPS**
                 A **lock** (A locked padlock) or **https://** means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites. 
  Menu Close
          Enter the terms you wish to search for.
    Search
        








  
  
    

  
      

                                      About HHS
    
                        
                              
      
      
      Programs & Services
    
                        
                              
      
      
      Grants & Contracts
    
                        
                              
      
      
      Laws & Regulations Breadcrumb
    Home
                              About
                              News
                              HHS’ Office for Civil Rights Settles Ransomware Cyber-Attack Investigation
 Navigate to:
  News
    
                                    
                                            
            
      
      
      
      Blog
    
                                    
                                            
            
      
      
      
      HHS Live
    
                                    
                                            
            
      
      
      
      Podcasts
    
                                    
                                            
            
      
      
      
      Media Guidelines for HHS EmployeesText resize icon

                    




**FOR IMMEDIATE RELEASE October 31, 2023**

        **Contact:
            HHS Press Office 
              202-690-6343media@hhs.gov**

          HHS’ Office for Civil Rights Settles Ransomware Cyber-Attack Investigation
    
    

      *OCR Settles with Business Associate in attack affecting over 200,000 individuals*

Today, the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR) announced a settlement under the Health Insurance Portability and Accountability Act (HIPAA) with Doctors’ Management Services, a Massachusetts medical management company that provides a variety of services, including medical billing and payor credentialing. The HIPAA Privacy, Security, and Breach Notification Rules set forth the requirements that HIPAA-regulated entities must follow to protect the privacy and security of health information. The $100,000 settlement resolves a large breach report regarding a ransomware attack that affected the electronic protected health information of 206,695 individuals. Ransomware is a type of malware (malicious software) designed to deny access to a user’s data, usually by encrypting the data with a key known only to the hacker who deployed the malware, until a ransom is paid. This marks the first ransomware agreement OCR has reached.

October is Cybersecurity Awareness Month, and OCR has been working with health insurers, providers, and clearinghouses covered by HIPAA to ensure better data security. Ransomware and hacking are the primary cyber-threats in health care. In the past four years, there has been a 239% increase in large breaches reported to OCR involving hacking and a 278% increase in ransomware. This trend continues in 2023, where hacking accounts for 77% of the large breaches reported to OCR. Additionally, the large breaches reported this year have affected over 88 million individuals, a 60% increase from last year.

“Our settlement highlights how ransomware attacks are increasingly common and targeting the health care system. This leaves hospitals and their patients vulnerable to data and security breaches.” said OCR Director, Melanie Fontes Rainer. “In this ever-evolving space, it is critical that our health care system take steps to identify and address cybersecurity vulnerabilities along with proactively and regularly review risks, records, and update policies. These practices should happen regularly across an enterprise to prevent future attacks.”

On April 22, 2019, Doctors’ Management Services filed a breach report with HHS stating that approximately 206,695 individuals were affected when their network server was infected with GandCrab ransomware. The initial unauthorized access to the network occurred on April 1, 2017; however, Doctors’ Management Services did not detect the intrusion until December 24, 2018, after ransomware was used to encrypt their files. In April 2019, OCR began its investigation.

OCR’s investigation found evidence of potential failures by Doctors’ Management Services to have in place an analysis to determine the potential risks and vulnerabilities to electronic protected health information across the organization. Other findings included insufficient monitoring of its health information systems’ activity to protect against a cyber-attack, and a lack of policies and procedures in place to implement the requirements of the HIPAA Security Rule to protect the confidentiality, integrity, and availability of electronic protected health information.

Under the terms of the settlement agreement, OCR will monitor Doctors’ Management Services for three years to ensure compliance with HIPAA. In addition, Doctors’ Management Services has agreed to pay $100,000 to OCR and to implement a corrective action plan, which identifies steps that Doctors’ Management Services will take to resolve potential violations of the HIPAA Privacy and Security Rules and protect the security of electronic protected health information, including:

Review and update its Risk Analysis to identify the potential risks and vulnerabilities to Doctor’s Management Services data to protect the confidentiality, integrity, and availability of electronic protected health information.
	Update its enterprise-wide Risk Management Plan (strategy to protect the confidentiality, integrity, and availability of ePHI) to address and mitigate any security risks and vulnerabilities found in the updated Risk Analysis.
	Review and revise, if necessary, its written policies and procedures to comply with the Privacy and Security Rules.
	Provide workforce training on HIPAA policies and procedures.OCR recommends health care providers, health plans, clearinghouses, and business associates that are covered by HIPAA take the following best practices to mitigate or prevent cyber-threats:

Review all vendor and contractor relationships to ensure business associate agreements are in place as appropriate and address breach/security incident obligations.
	Risk analysis and risk management should be integrated into business processes; conducted regularly and when new technologies and business operations are planned.
	Ensure audit controls are in place to record and examine information system activity.
	Implement regular review of information system activity.
	Utilize multi-factor authentication to ensure only authorized users are accessing ePHI.
	Encrypt ePHI to guard against unauthorized access to ePHI.
	Incorporate lessons learned from incidents into the overall security management process.
	Provide training specific to organization and job responsibilities and on regular basis; reinforce workforce members’ critical role in protecting privacy and security.OCR regularly provides guidance and information to the health care industry to support data privacy and security.  In October, which is Cybersecurity Awareness month, OCR did the following to support improved cybersecurity:

Telehealth Privacy and Security Tips for Patients
	Resource for Health Care Providers on Educating Patients about Privacy and Security Risks to Protected Health Information when Using Remote Communication Technologies for Telehealth
	Cybersecurity Newsletter on Security Rule Sanctions
	Video on Common Cyber-Attacks – English/Spanish
	OCR hosted a webinar this month discussing The HIPAA Security Rule Risk Analysis Requirement.
	OCR’s eight regional offices have conducted cybersecurity training to large hospitals, small medical providers, business associates, state health departments, and state social service agencies to assist them in complying with their cybersecurity obligations in the face of changing hostile threats.The resolution agreement and corrective action plan may be found at: https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/dms-ra-cap/index.html

OCR is committed to enforcing the HIPAA Rules that protect the privacy and security of peoples’ health information. Guidance about the Privacy Rule, Security Rule, and Breach Notification Rules can also be found on OCR’s website.

If you believe that your or another person’s health information privacy or civil rights have been violated, you can file a complaint with OCR at https://www.hhs.gov/ocr/complaints/index.html.
  

    ###
    Note: All HHS press releases, fact sheets and other news materials are available at https://www.hhs.gov/news.Like HHS on Facebook, follow HHS on Twitter @HHSgov, and sign up for HHS Email Updates.Last revised: October 31, 2023

  
  
  







  Sign Up for Email Updates

Receive the latest updates from the Secretary, Blogs, and News Releases

Sign Up







  Subscribe to RSS
    

      Receive latest updates







  Related News Releases
    

      HHS shares its Plan for Promoting Responsible Use of Artificial Intelligence in Automated and Algorithmic Systems by State, Local, Tribal, and Territorial Governments in the Administration of Public Benefits
  

HHS Announces Phase 1 Winners in Environmental Justice Community Innovator Challenge
  

Biden-Harris Administration Announces $700 Million in Bipartisan Infrastructure Law Funding, Partnership with Bureau of Reclamation at White House Clean Water Summit







  Related Blog Posts
    

      Donate Blood and Help Save Lives
  

The U.S. Department of Health and Human Services Is Taking Action to Strengthen Primary Care
  

Improving Data to Support the Home- and Community-Based Workforce

                    
  


Media Inquiries

For general media inquiries, please contact media@hhs.gov.







  Content created by Assistant Secretary for Public Affairs (ASPA) Content last reviewed October 31, 2023 Back to top
    Contact HHS
    
                        
                                            
      
      
      Careers
    
                        
                                            
      
      
      HHS FAQs
    
                        
                                            
      
      
      Nondiscrimination NoticeHHS Archive
    
                        
                                            
      
      
      Accessibility Statement
    
                        
                                            
      
      
      Privacy Policy
    
                        
                                            
      
      
      Viewers & PlayersBudget/Performance
    
                        
                                            
      
      
      Inspector General
    
                        
                                            
      
      
      Web Site Disclaimers
    
                        
                                            
      
      
      EEO/No Fear ActFOIA
    
                        
                                            
      
      
      The White House
    
                        
                                            
      
      
      USA.gov
    
                        
                                            
      
      
      Vulnerability Disclosure Policy
        Sign Up for Email Updates

Receive the latest updates from the Secretary, Blogs, and News Releases.

Sign Up
  HHS Headquarters
          200 Independence Avenue, S.W.
                  Washington, D.C. 20201
                  Toll Free Call Center: 1-877-696-6775​