HHS Office for Civil Rights Settles HIPAA Ransomware Cybersecurity Investigation for $90,000

"On 10 May 2022, OCR received a breach report concerning a ransomware incident at Bryan County Ambulance Authority (BCAA), affecting 14,273 patients. BCAA agreed to pay $90,000 and implement a corrective action plan to ensure compliance with HIPAA Security Rule." The settlement marks the first enforcement action in OCR's Risk Analysis Initiative, created to focus on compliance with the HIPAA Security Rule Risk Analysis provision. OCR enforces HIPAA Privacy, Security, and Breach Notification Rules to protect protected health information.