Florida Firm Fined $337K by Feds for Data Deleted in Hack

A Florida-based behavioral health holding company has paid federal regulators a $337,750 HIPAA settlement for a 2018 incident involving the deletion of electronic protected health information pertaining to nearly 3,000 patients. How should other entities avoid these data loss situations?

See Also: The Healthcare CISO’s Guide to Medical IoT Security

In addition to paying the financial penalty, USR Holdings, a business associate to behavioral health centers including its own subsidiaries, also agreed to implement a corrective action plan as part of its resolution agreement with the U.S. Department of Health and Human Services released Wednesday.

The settlement resolves an investigation into hacking incident USR reported to HHS’ Office for Civil Rights in February 2019.

USR reported that from Aug. 23, 2018, through Dec. 8, 2018, a database containing the ePHI of 2,903 individuals was accessed by an unauthorized third party who was able to delete ePHI in the database.

A sample breach notice USR also filed with the Massachusetts attorney general’s office in February 2019 said USR became aware of unusual activity in a server that stored information pertaining to three behavioral health centers on Dec. 8, 2023. The affected facilities were Amethyst Recovery Center and The Freedom Center, which are owned by USR, and also New England Recovery and Wellness Center, which appears to be owned by a non-USR company.

In the breach notice, the company said its investigation into the incident, aided by a digital forensic firm, determined that on Aug. 23, 2023, a USR staff member made a configuration change to a firewall, resulting in the database server being accessed by an unknown third party.

HHS OCR’s investigation into USR’s data deletion incident found potential violations of the HIPAA security and privacy rules, the agency said. That included failures to conduct an accurate and thorough risk analysis to determine risks and vulnerabilities to ePHI in its systems; to regularly review its information system activity; and to establish and implement procedures to create and maintain retrievable exact copies of ePHI.

Under the settlement’s corrective action plan, USR is required to conduct an accurate and thorough HIPAA security risk analysis; implement a risk management plan to address and mitigate security risks and vulnerabilities identified in the risk analysis; develop a process to evaluate any environmental or operational changes that affect the security of ePHI; develop, maintain and revise as necessary, its written policies and procedures to comply with the HIPAA rules; and distribute any updated HIPAA policies and procedures to its workforce.

As part of the settlement agreement, HHS OCR will also monitor USR’s HIPAA compliance for two years.

“Healthcare entities need to ensure that they are proactively monitoring who is in their information systems, and that they have backup procedures in place to be able to create exact copies of the electronic protected health information they hold, in the event health information is held for ransom or deleted,” Melanie Fontes Rainer, HHS OCR director said in a statement.

“Effective cybersecurity includes being able to restore access to electronic health information following a cybersecurity attack, so there is no interruption in the provision of healthcare.”

USR did not immediately respond to Information Security Media Group’s request for comment on the settlement and for additional details about the breach, including whether the incident involved a ransom demand by hackers.

Avoiding Data Loss

The USR breach is certainly not the first or largest reported to HHS OCR in recent years involving data deletion. In May 2021, 20/20 Eye Care and Hearing Care Network, a vision and hearing benefits administrator, notified nearly 3.3 million individuals that their personal and health information contained in an Amazon Web Services cloud storage bucket was accessed or downloaded – and then deleted – by an “unknown” actor (see: Health Data for Millions Delated from Cloud Bucket).

But sometimes the loss of patient records following a hacking incident has even more drastic results.

In 2019, Brookside ENT and Hearing Center, a two-doctor practice in Michigan, in late 2019 permanently shut down in the aftermath of a ransomware attack. The practice said it had lost access to patient medical records, billing, scheduling and other critical data after attackers encrypted the data.

Rather than pay a ransom to get a decryption key or attempt to restore the data, the physicians decided to retire (see: Medical Practice Closes in Wake of Ransomware Attack).

“Disaster recovery plans, data backup plans, and testing have been a part of the HIPAA security rule’s contingency plan section for 20 years now,” said Keith Fricke, a partner at privacy and security consultancy tw-Security.

“Timely recovery of accurate copies of PHI relies upon establishing recurring backups, executed at a frequency commensurate with the recovery time objective and recovery point objective for the system handling the PHI,” he said.

In addition, creating offline “gapped” backups are crucial in ensuring data is available for recovery without worry of intentional tampering or destruction, he said. “Criminals deploying ransomware often times gain unauthorized access to an organization’s network, seeking to first cripple the ability to restore from backups.”

This aids the criminals in forcing victims to pay a ransom, he said. “The biggest oversight we see is the lack of consistent monitoring of backup jobs. It is important to review activity logs of backup systems to confirm backups completed successfully and error-free. If errors are detected, measures can be taken to correct the issue. The time to discover backups haven’t been executing as expected is when you need to restore data.”

HHS OCR’s enforcement action against USR is the agency’s third – and largest – HIPAA settlement announced so far in 2025.

Elgon, a Massachusetts firm that provides billing and other services to home health agencies, and Virtual Private Network Solutions, a Virginia-based data hosting and cloud provider, were respectively levied fines of $80,000 and $90,000 as part of HIPAA settlements announced earlier this week. Both those settlements followed HHS OCR’s investigations into two separate ransomware breaches reported by the Elgon and VPS Solutions (see: 2 HIPAA Business Associates Pay Ransomware Settlements).