HHS Office for Civil Rights Settles HIPAA Security Rule Failures for $950,000

The US Department of Health and Human Services’ Office for Civil Rights (OCR) has settled with Heritage Valley Health System over potential violations of the Health Insurance Portability and Accountability Act (HIPAA) Security Rule. The case follows a ransomware attack on the healthcare provider. Legacy Valley is to pay $950k and implement a three-year OCR-monitored corrective plan. OCR has also detailed ways other organisations can mitigate similar cyber-threats.