Health System to Pay $950,000 to Resolve HHS Privacy Violations

The Department of Health and Human Services’ Office for Civil Rights announced a settlement with Heritage Valley Health System concerning potential violations of the Health Insurance Portability and Accountability Act security rule following a ransomware attack, the agency said Monday.

An investigation revealed the health system’s failures to conduct a compliant risk analysis to determine the potential risks and vulnerabilities to electronic protected health information in its systems, implement a contingency plan to respond to emergencies, and implement policies and procedures to allow only authorized users access to electronic protected health information.

The health system, which provides care in ...