Get Permission
The Department of Health and Human Services has slapped insurer Excellus Health Plan with a $5.1 million settlement in the wake of a 2015 breach that affected more than 9.3 million individuals.
Excellus, which serves upstate and western New York, in September 2015 filed a breach report stating that intruders had gained unauthorized access to its information systems, HHS’ Office for Civil Rights says in a statement Friday.
The Blue Cross Blue Shield health plan reported that the breach began on or before Dec. 23, 2013, and ended on May 11, 2015.
”The hackers installed malware and conducted reconnaissance activities that ultimately resulted in the impermissible disclosure of the protected health information of more than 9.3 million individuals, including their names, addresses, dates of birth, email addresses, Social Security numbers, bank account information, health plan claims, and clinical treatment information,” OCR says.
Get Permission
In a ruling that could have a profound impact on HIPAA enforcement, a U.S. Court of Appeals has vacated a $4.3 million HIPAA civil monetary penalty levied by federal regulators against the University of Texas MD Anderson Cancer Center in the wake of three breaches involving unencrypted mobile devices. The court called the penalty “arbitrary, capricious and contrary to law.”
In its ruling, the 5th Circuit U.S. Court of Appeals in Louisiana was critical of the Department of Health and Human Services Office for Civil Rights’ interpretation of HIPAA requirements and how it sets civil monetary penalties.