Medical management company to pay $100K in landmark HHS ransomware case

A Massachusetts-based medical management company agreed to pay $100,000 in settling the first ransomware agreement under the Health Insurance Portability and Accountability Act (HIPAA) reached by the Department of Health and Human Services’ Office for Civil Rights (HHS OCR).

Doctors’ Management Service filed a breach report with the HHS in April 2019 regarding a ransomware attack that impacted more than 200,000 individuals, the agency said in a press release Tuesday. The company first detected the breach in December 2018, though it determined the initial access dated back to April 2017.

The HIPAA privacy, security, and breach notification rules set requirements regulated entities must follow to protect the privacy and security of health information.