Ransomware and HIPAA: when an attack is a breach.
A ransomware attack on a vendor or on the employer is a security incident under HIPAA. Whether it is also a reportable breach depends on the facts, and HHS presumes a breach unless a documented assessment shows otherwise.
What HHS says.
A Security Incident By Definition
HHS says the presence of ransomware or any malware is a security incident under HIPAA. Employers should treat a malware alert on any system that stores plan information as a possible reportable event. Involve counsel and the security team early, and do not wait for the full picture before starting the review.
It May Also Be A Breach
It may also result in an impermissible disclosure of protected health information and a breach, depending on the facts. Whether it becomes a breach depends on what information was involved and whether it was actually accessed. Counsel and the security team should look at the facts together, and the conclusion should be recorded in writing.
A Breach Is Presumed
Unless the entity can show a low probability that the information was compromised, using the factors in the Breach Notification Rule, a breach is presumed. The default position is that a breach happened unless the organization can show otherwise. That is why the review has to be based on the specific factors in the rule, with the reasoning written down.
The Assessment Must Be Thorough
HHS says the assessment must be completed in good faith and reach reasonable conclusions. A quick gut call is not enough. Use a documented process, include people who understand the systems and the data, and have counsel review the conclusion before the organization decides whether notices are needed.
What the Security Rule requires before an incident.
Risk Analysis
A required assessment of risks and vulnerabilities to the confidentiality, integrity and availability of electronic health information. A risk analysis should look at where plan data lives, who can reach it and what could go wrong. Repeat it on a regular schedule and when systems or vendors change, and keep the results on file.
Risk Management
Required measures that reduce those risks to a reasonable and appropriate level. After the analysis, the organization needs a plan to reduce the risks it found. Write down what will be done, who owns each step and by when, and revisit progress during the year.
Incident Procedures
Required procedures to respond to security incidents, lessen harm, and document incidents and outcomes. A written incident procedure helps teams act fast when something looks wrong. It should name who is told first, how the issue is contained, how the response is recorded and how lessons are used afterward.
Data Backup Plan
A required plan to create and maintain retrievable exact copies of electronic health information. Backups are only useful if they can be restored, so check that they are complete and kept separate from the main systems. Test a restore now and then rather than assuming it will work.
Disaster Recovery And Emergency Operations
Required plans to restore lost data and to keep critical business processes running while protecting information in an emergency. A recovery plan covers how systems come back after an outage, and an emergency plan covers how key work continues in the meantime. Write both down and make sure the people involved have copies.
Testing And Criticality Review
Periodically testing and revising contingency plans, and assessing how critical each application and data set is, are addressable specifications. These are called addressable, which means the organization should consider them and decide what is reasonable, then document its choice. Review how important each system is and test the plans on a regular schedule.
Source: 45 CFR 164.308.
Before and after an attack.
Plan The Response In Advance
Write down who is called, who decides, and who runs the assessment. Name an incident lead, a decision maker and the person who contacts counsel, vendors and insurers. Keep an up-to-date contact list where it can be reached even if the main systems are down.
Preserve Evidence And Document
Record what was affected and how you assessed the risk. Keep a log of what systems were affected, what data was involved and how the risk was assessed. Save relevant records before cleanup begins, because wiping a system can erase information needed for the review.
Know The Notice Clock
If it is a breach, notice to individuals is due as soon as reasonably possible and within 60 days of discovery. The deadline starts when the incident is discovered, not when the review is finished, so move quickly. Counsel can confirm when the clock started and whether any state requirements apply as well.
Check Your Vendors
Ask vendors what they will do and how fast they will tell you. Review service agreements to see how quickly a vendor must tell you about an incident and what help it provides. Ask who to contact, and make sure the contact information is current.
Three questions to settle.
Is Our Information Encrypted
HHS notes that information encrypted and not accessed may be treated differently from information that was open when the malware ran. Encryption can lower the risk, but it only helps if it was in place on the affected systems and the data was protected when the malware ran. Ask counsel and the security team how it applies to your case.
Who Makes The Breach Call
Decide in advance who signs off on the assessment. Put the name of the decision maker in the written incident plan, along with a backup if that person is out. Clear authority keeps the review moving and makes it easier to show how the decision was reached.
Who Pays For Notices And Response
Check the vendor agreements for who bears the cost of breach response, and raise it with your counsel. Review who pays for notices, call centers, credit monitoring and legal help under each vendor agreement. Raise gaps with counsel before an incident, and ask the broker or insurer about any cyber coverage in place.
Common Questions About Ransomware And HIPAA
Is every ransomware attack a reportable breach?
No. It depends on the facts, but a breach is presumed unless a documented assessment shows a low probability of compromise.
What does the assessment look at?
The four factors in the Breach Notification Rule, covered on our breach page.
Does encryption help?
It can. HHS describes situations where encrypted information was not accessed differently from situations where a user opened information before the attack.
Who notifies if the vendor is attacked?
The vendor must notify the plan, and the plan then handles notices to individuals and HHS.
How soon must we act?
As soon as reasonably possible and no later than 60 days after discovery for individual notice.
Is this legal advice?
No. For an actual incident, call your counsel right away. We can help with planning.
Send us your renewal.
We’ll tell you whether it looks competitive, where we see opportunity, and the five questions we’d put to your carrier. No cost, and no obligation to move anything.
The renewal letter
Your current plan summary
Contribution split by tier
Enrolled counts by tier
Four documents — two more if your group is 50 or more. Nothing else; every extra one is a reason to postpone.
Laws and rules referenced
45 C.F.R. Part 164, Subpart C — HIPAA Security Rule for electronic protected health information.
45 C.F.R. § 164.404 — Breach notification to individuals.
This page is general information, not legal or tax advice. Rules change and facts matter, so confirm your situation with counsel or a qualified advisor.
An independent employee benefits consulting firm. We look at the entire benefits program: cost, plan performance, risk and administration.
Switch to CFH. Unhappy with your broker? Your employees won’t notice. You will. →
Cookies on This Site
We use cookies to keep the site working properly and to understand how it is used. You can decline anything that is not essential. See our Privacy Policy for the detail.
- Essential: needed for the site to load and for you to move around it. These cannot be switched off.
- Analytics: tell us which pages get read, so we know what is worth writing more of.
- Advertising: set by third parties such as ad and social platforms to measure and target campaigns.