HHS Fines Neurology Practice $25K for Ransomware Attack

Federal regulators fined a New York neurology practice $25,000 following an investigation into a 2020 ransomware breach affecting nearly 7,000 individuals.

See Also: 2023 Ransomware Preparedness: Key Findings, Readiness and Mitigation

The U.S. Department of Health and Human Services said it determined that Comprehensive Neurology – a Hollis, New York-based specialty practice with five staff members – failed to conduct an accurate and thorough risk analysis to determine the potential risks and vulnerabilities to its electronic protected health information. The settlement also imposes a corrective action plan on the practice.

The settlement is HHS’ Office for Civil Rights’ 12th ransomware-related HIPAA enforcement action since that effort was kicked off in 2023. It marks the eighth enforcement action under the agency’s security risk analysis initiative, which launched last year.

HHS OCR Comprehensive Neurology in December 2020 informed that approximately 6,800 individuals were have affected by the incident, during which hackers maliciously encrypted all patient files. Compromised information included patient names, clinical information, health insurance information, Social Security and driver’s licenses numbers.

Besides paying a $25,000 financial settlement, under the terms of the resolution agreement signed on Feb. 7, Comprehensive Neurology has agreed to implement a corrective action plan that HHS OCR will monitor for two years.

That includes Comprehensive Neurology conducting an accurate and thorough security risk analysis, developing and implementing a risk management plan to mitigate security risks and vulnerabilities identified in said analysis and training its workforce on HIPAA policies and procedures.

Comprehensive Neurology declined Information Security Media Group’s request for comment on its settlement with HHS OCR.