HHS Office for Civil Rights releases ransomware guidance

OCR Director Jocelyn Samuels

The U.S. Department of Health and Human Services Office for Civil Rights has released its guidance to help healthcare organizations handle ransomware attacks, including prevention methods, a detailed description of ransomware and advice on how to respond to a ransomware threat.

One important highlight is the reiteration that both malware and ransomware constitute a security incident under HIPAA. Therefore, any affected organizations must initiate security incident response and reporting procedures.

Further, unless the provider, insurer or associate can prove a 'low probability' patient health records have been compromised, according to the report, affected patients must be notified per HIPAA regulations.

"One of the biggest current threats to health information privacy is the serious compromise of the integrity and availability of data caused by malicious cyberattacks on electronic health information systems, such as through ransomware," said OCR Director Jocelyn Samuels in a prepared statement.

[Also: Healthcare cybersecurity must be proactive not reactive, expert says]

The guidance acts as reinforcement to current HIPAA standards, which is intended to help healthcare providers prevent, detect and contain ransomware threats, Samuels added.

Providers should utilize HIPAA's Security Rule, specifically the Security Management Process to "conduct an accurate and thorough risk analysis of the potential risks and vulnerabilities to the confidentiality, integrity and availability of all of the ePHI," according to the guidance.

Authorized users need to be trained on how to detect and report malicious software, while ePHI access should be limited to persons and software requiring access, as well.

[Also: As count of cyberattacks swells, healthcare orgs seek extra insurance against losses]

Additionally, the report stressed the need for a complete contingency plan, including the use of data backups to recover a system from a breach. Offline backups, unavailable to the network, are the best way to prevent the disruption of care. The guidance authors also recommended affected organizations should contact local FBI or U.S. Secret Service for assistance.

"Organizations need to take steps to safeguard their data from ransomware attacks," Samuels said. "HIPAA-covered entities and business associates are required to develop and implement security incident procedures and response and reporting processes that are reasonable and appropriate to respond to malware and other security incidents."

Access to the full report can be found on the HHS Office for Civil Rights website.

This article first appeared in Healthcare IT News.

Twitter: @JessiefDavis