One of the challenging things about HIPAA (Health Insurance Portability and Accountability Act) enforcement is the fact that both the Office for Civil Rights and State AGs have jurisdiction to assess fines and penalties for HIPAA violations. The old double whammy.
States enforce those rights sparingly, but New Jersey is getting itself on the map by enforcing HIPAA and assessing fines and penalties and/or settling with entities for alleged HIPAA violations. This year, it has already racked up several settlements with companies over alleged violations of both state law and HIPAA.
The most recent settlement involved a case that stemmed from a business email compromise (BEC) incident in which several Regional Cancer Care Associates’ email accounts were compromised through a targeted phishing campaign and the employees disclosed their credentials to a threat actor. As a result of the BEC, the protected health information of more than 105,000 individuals was compromised, including names, addresses, driver’s license numbers, and Social Security numbers.
More than 80,000 of the affected individuals reside in New Jersey, hence the interest of the New Jersey Division of Consumer Affairs (Division) in the AG’s office. The Division alleged violations of both the New Jersey Consumer Fraud Act and HIPAA. According to Acting Attorney General Bruck when announcing the settlement, “New Jerseyans battling cancer should never have to worry about whether their medical providers are properly securing and protecting their personal information from cyber threats. We require healthcare providers to implement adequate security measures to protect patient data, and we will continue to hold accountable companies that fall short.”
Note to covered entities and business associates in New Jersey: your AG is active in this space, so dusting off your HIPAA compliance program and Written Information Security Program might be a high priority for the new year.