Leading Employers Back Expansion of Electronic Prior Authorization to Self-Funded Health Plans – HHS.gov
Jefferson County Health Department Pays $2.25M to Settle Data Breach Lawsuit – The HIPAA Journal
Jefferson County Health Department Pays $2.25M to Settle Data Breach Lawsuit
Jefferson County Health Department, a public health agency for Jefferson County in Hillsboro, Missouri, has agreed to settle class action litigation that was initiated in response to a 2022 data security incident.
The incident that sparked the litigation was identified on or around November 15, 2022. The forensic investigation determined that its network was accessed by an unauthorized third party between October 31 and November 15, 2022, who potentially viewed or obtained personal and protected health information such as names, dates of birth, Social Security numbers, driver’s license numbers, financial account information, medical information, and health insurance information. The data breach was reported to the HHS’ Office for Civil Rights on January 13, 2023, as involving the protected health information of 115,940 individuals.
The first class action lawsuit was filed on January 27, 2023, and was consolidated with a second complaint on October 2, 2023. The consolidated lawsuit – J.D., et al. v. Jefferson County Health Center d/b/a Jefferson County Health Department – is pending in the Circuit Court of the City of St. Louis, State of Missouri.
The consolidated lawsuit alleged that the plaintiffs would not have sought healthcare services from Jefferson County Health Center if they knew that their personal and health information would not be adequately protected. They claim that the failure to implement appropriate cybersecurity measures constituted negligence, breach of contract, breach of fiduciary duty, and violated the covenant of good faith and fair dealing. Jefferson County Health Department maintains that there was no wrongdoing and does not believe there is any liability or that there were any damages. A motion to dismiss the lawsuit was denied by the court, and a settlement was ultimately negotiated that was acceptable to all parties and avoids the cost and risks associated with a trial and related appeals.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Under the terms of the settlement, Jefferson County Health Department has agreed to establish a $2.25 million settlement fund, from which attorneys’ fees and expenses, settlement administration costs, and service awards for the three class representatives will be deducted. The remainder of the fund will be used to pay for benefits to the class members.
Class members may either submit a claim for reimbursement of documented, unreimbursed losses due to the data breach up to a maximum of $300 per class member, including up to three hours of lost time at $20 per hour. Individuals who do not submit a claim for reimbursement of losses and lost time may claim a one-time cash payment of $150. The deadline for exclusion from the settlement, objection, and submitting a claim is November 16, 2026. The final fairness hearing has been scheduled for December 10, 2026.
The post Jefferson County Health Department Pays $2.25M to Settle Data Breach Lawsuit appeared first on The HIPAA Journal.
HHS Sends Letters of Nonconformity to Suspected Information Blockers
The U.S. Department of Health and Human Services (HHS) Office of the National Coordinator for Health IT (ONC) has sent warning letters to seven health IT companies suspected of engaging in information blocking, in violation of the information blocking rules of the 21st Century Cures Act. The recipients of the letters of nonconformity have not been named, as the HHS declines to make such information public when there are active investigations; however, the companies will be named if there are any corrective actions, financial penalties, suspensions, or terminations due to noncompliance.
In September last year, the HHS announced that it would be actively enforcing compliance with the information blocking regulations and would take action against any entity that blocks patients, providers, or other entities from legally obtaining access to health information. The maximum penalty for an information blocking violation is $1 million per violation; however, no penalties for information blocking have been imposed to date, and there have been no suspensions or terminations.
At the annual ADAPT conference on October 15, Thomas Keane, HHS National Coordinator for Health IT, said most of the recipients of the letters of nonconformity have responded by remediating the allegations of restricted data access and have agreed to change their data sharing practices. Keane said his office is keen to work with health IT companies to ensure that they understand the requirements but will adopt an enforcement stance if data sharing practices are not voluntarily changed.
Keane confirmed that ONC is working with the Justice Department, HHS Office of Inspector General, and the Federal Trade Commission to enforce the information blocking regulations. Amy Gleason, administrator of the U.S. DOGE Service and Chief Product Officer at the Centers for Medicare and Medicaid Services (CMS), said the CMS is taking troubleshooting calls to help get patient data flowing, stating that there have only been two such calls to date.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The post HHS Sends Letters of Nonconformity to Suspected Information Blockers appeared first on The HIPAA Journal.
Feds Issues Advisory About SafePay Ransomware Group – The HIPAA Journal
Feds Issues Advisory About SafePay Ransomware Group The HIPAA Journal
Feds Issues Advisory About SafePay Ransomware Group
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), Secret Service (USSS), and cybersecurity agencies in Germany and the United Kingdom have issued a joint cybersecurity advisory about the SafePay ransomware group.
SafePay is a financially motivated threat group that has been in operation since August 2024 and targets businesses and critical infrastructure entities in North and South America, Europe, and Australia. The group engages in double extortion tactics, exfiltrating data, encrypting files with ransomware, and issuing ransom demands, payment of which is required to unlock files and prevent stolen data from being leaked online.
Just two months after the group was first identified, it attacked the U.S. business service provider Conduent Business Services and exfiltrated 8.5 terabytes of data. Conduent reported the incident as affecting 62.2 million individuals. The incident ranks as the third-largest U.S. healthcare data breach of all time. The group has accelerated attacks and is now one of the most prolific ransomware groups, having attacked more than 600 entities from multiple critical infrastructure sectors.
The security advisory includes the latest tactics, techniques, and procedures (TTPs) observed by the authoring agencies and security researchers. SafePay actors use a variety of techniques for initial access, including brute force password attacks, credential exposure, and vulnerability exploitation for edge devices, including the Cisco Adaptive Security Appliance vulnerabilities CVE-2023-20269 and CVE-2020-3259; the Veeam Backup & Replication vulnerabilities CVE-2023-27532 & CVE-2024-40711; and the SonicWall SonicOS vulnerability CVE-2024-40766. VPNs are also targeted, especially the Mullvad VPN provider, using phished account profiles.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Once networks are compromised, SafePay actors take over existing accounts or create new ones and use legitimate system tools for credential theft, network scanning, lateral movement, and data exfiltration. Valuable files are identified and exfiltrated, security protections are disabled, files are encrypted, and ransom notes are dropped.
The authorizing agencies recommend regularly patching and updating systems, prioritizing patches for the above-mentioned vulnerabilities and other known exploited vulnerabilities (KEVs). Administrative tools and privileges should be restricted, and the Zero Trust Principle should be implemented. Account security should be strengthened by implementing identity, credential, and access management (ICAM) policies and multifactor authentication. Indicators of Compromise (IoCs), detailed TTPs, and further recommendations are detailed in the security advisory.
The post Feds Issues Advisory About SafePay Ransomware Group appeared first on The HIPAA Journal.