Ambulance Billing Firm Pays $515K Fine to 2 States in Hack

An ambulance billing and collections firm will pay $515,000 to Massachusetts and Connecticut regulators and implement an information security program to settle state investigations into a 2022 ransomware incident affecting the sensitive information of nearly 350,000 New Englanders.

See Also: Demonstrating HIPAA Compliance

The attorneys general of both states said Wednesday that Massachusetts-based Comstar agreed to pay Massachusetts $415,000 and Connecticut $100,000 to settle allegations the company violated federal HIPAA and state data privacy regulations.

A threat actor in March 2022 accessed, encrypted, and held for ransom files and servers maintained by Comstar, the states said.

The incident compromised the information of 326,426 Massachusetts residents and 22,829 Connecticut residents.

Compromised data included patient name, date of birth, medical assessment and medication administration, health insurance information, driver’s license, financial account information and Social Security number (see: Hacks Spotlight PHI Risks for Ambulance Cos., Vendors).

The states’ settlements with Comstar are not the first enforcement actions against the company involving that same breach.

Comstar last June agreed to pay the U.S. Department of Health and Human Services a $75,000 fine and implement a data security corrective action plan (see: Ambulance Billing Firm Pays Feds $75K in Ransomware Breach).

HHS said the Comstar breach affected 70 of the company’s clients and nearly 586,000 individuals across the United States. A federal investigation determined that Comstar failed to conduct a timely and thorough HIPAA security risk analysis.

Detailed Security Program

Comstar’s settlements with the states require the company to implement a detailed information security program to help avoid similar incidents in the future.

Under the agreements, Comstar must develop, implement, maintain, comply with and document a comprehensive information security program to safeguard protected health information and personally identifiable information.

Among a long list of measures that Comstar must adopt “where feasible” are the principles of zero trust architecture, multifactor authentication, including for remote access, phishing protection software, encryption, use of security information and event management platform, a vulnerability management program and password management.

That includes hashing passwords stored online “using an appropriate algorithm that is not vulnerable to a collision attack together with an appropriate salting policy, or other equivalent or stronger protections.”

The company also agreed to not maintain more than two years’ worth of records in its live database. “To the extent required by applicable law, Comstar will archive 2-to-7-year-old records within its offline archive database,” with archiving performed at a minimum on a quarterly basis, settlement documents said.

Comstar must put into place a qualified CISO and ensure that individual regularly and directly reports to the CEO on at least a semi-annual basis about Comstar’s security posture.

Comstar’s corrective action plan under its settlement with HHS OCR’s included some of those same security improvement requirements.

Comstar did not immediately respond to Information Security Media Group’s request for comment.

The Massachusetts and Connecticut AG settlements with Comstar await final court approvals in both states.

Comstar is among several regulated healthcare firms in recent years to face HIPAA penalties from both state and federal regulators in the aftermath of the same health data breach.

Among the most notable of such cases was a record $16 million fine that Anthem Inc. paid to HHS’ Office for Civil Rights in 2018, and an additional $48.2 million in settlements with a coalition of 42 state attorneys general in 2020, following the health insurer’s 2014 cyberattack that affected nearly 79 million people nationwide.

The HITECH Act of 2009 granted state attorneys general the authority to enforce HIPAA violations, and the HIPAA Omnibus Rule of 2013 further enabled them to bring civil actions on behalf of state residents to obtain monetary damages or injunctive relief for violations of the HIPAA rules.