Solara Medical Supplies HIPAA Settlement
The U.S. Department of Health and Human Services (HHS) and Office of Civil Rights (OCR) has reached a $3 million settlement with Solara Medical Supplies, LLC after a phishing attack compromised the electronic protected health information (ePHI) of over 114,000 individuals. The breach resulted from unauthorized access to eight employee email accounts. Additionally, Solara mistakenly sent breach notification letters to incorrect addresses. OCR found multiple HIPAA violations, including failure to conduct a proper risk analysis, inadequate security measures, and delayed breach notifications.
As part of the settlement, Solara must:
- • Conduct a thorough risk analysis to identify vulnerabilities.
- • Implement a risk management plan to mitigate security threats.
- • Update policies and procedures to comply with HIPAA regulations.
- • Train employees on security practices and HIPAA compliance.
Illinois Department of Human Services (IDHS) Data Breach
According to an IDHS media notification, a compromised email account led to a massive data breach. The breach affected 1,118,993 clients, exposing names, public assistance account numbers, and in some cases, Recipient ID numbers, birth dates, and mobile phone numbers. Additionally, Social Security numbers of 4,701 clients and three staff members were compromised.
The Growing Threat of Phishing in Healthcare
Phishing attacks remain a major cybersecurity threat, particularly in healthcare, where sensitive data is at risk. Your practice must take proactive measures to protect against phishing, including:
- • Conducting Regular Risk Assessments: Identify and address security vulnerabilities.
- • Strengthening Security Measures: Use multi-factor authentication and encryption to safeguard PHI.
- • Training Employees: Educate staff on phishing threats and cybersecurity best practices.
By implementing strong cybersecurity practices, your practice can mitigate risks, prevent cyberattacks, and protect sensitive patient information.
TLD Systems has assisted many practice in implementing these security measures to protect the sensitive patient information they are responsible for. In addition, we have been brought in to assist practice who have experienced HIPAA breaches and implemented our HIPAA Risk Assessment program in their office. As a result, those practices that did experience were able to avoid fines from the OCR as a result of their implementation of our services.
Contact TLD Systems at info@tldsystems.com for assistance.
Read Comments