Guam Hospital Pays Feds $25K to Settle HIPAA Investigation

A Guam public hospital has agreed to pay federal regulators $25,000 and implement a corrective action plan to settle potential HIPAA violations – including a failure to conduct a comprehensive risk analysis – identified during an investigation into two security incidents.

See Also: Top 10 Technical Predictions for 2025

The U.S. Department of Health and Human Services’ Office for Civil Rights said the settlement with Guam Memorial Hospital Authority involves HHS OCR’s investigation into a complaint filed in January 2019 about a ransomware incident that occurred in December 2018 and affected the protected health information of 5,000 people.

During that investigation, HHS OCR received another complaint against GMHA on March 17, 2023.

“HHS’s investigation of that complaint revealed that two former employees had accessed GMHA’s network systems in March 2023 after their employment had ended,” HHS OCR said in the resolution agreement with GMHA.

HHS OCR said its investigation into the two incidents found that GMHA had failed to conduct an accurate and thorough risk analysis to identify potential risks and vulnerabilities to electronic protected health information held by GMHA.

“Ransomware and hacking are the primary cyberthreats to electronic protected health information within the healthcare industry,” said Anthony Archeval, HHS OCR acting director in a statement Thursday.

“Failure to conduct a HIPAA risk analysis puts this information at risk and vulnerable to future ransomware attacks and other cyberthreats,” he said.

Under the corrective action plan, GMHA has agreed to ensure compliance with the HIPAA Security Rule and protect the security of ePHI. GMHA must:

• Conduct an accurate and thorough risk analysis to identify potential risks and vulnerabilities to it ePHI;
• Develop and implement a risk management plan to address and mitigate security risks and vulnerabilities identified in its risk analysis;
• Develop a written process to regularly review records of information system activity, such as audit logs, access reports and security incident tracking reports;
• Enhance its HIPAA and security training program for its entire workforce;
• Bolster workforce security and information access management by reviewing all access credentials that have been granted access to ePHI.

GMHA did not immediately respond to Information Security Media Group’s request for comment on its settlement with HHS OCR.

The settlement with GMHA is HHS OCR’s 11th ransomware enforcement action and seventh enforcement action since the agency launched its Risk Analysis Initiative in 2024 (see: Radiology Practice Pays Feds $350,000 In HIPAA Settlement).

The resolution agreement with GMHA is also the 10th HIPAA enforcement action HHS OCR has announced so far in 2025. But the GHMA settlement – which was signed on Feb. 6, appears to be the first enforcement action finalized by HHS OCR since the Trump administration took office.

The nine other HIPAA enforcement actions announced so far this year by HHS OCR were finalized during the final months of the Biden administration.