California Attorney General Issues Guidance On Health Data Privacy Issues

Citing "multiple unreported ramsomware attacks" targeting the healthcare sector, last month the California Attorney General (CA AG) issued guidance reminding healthcare entities of their requirements under state and federal health data privacy laws to implement adequate security measures and comply with breach notification requirements. Although the document does not provide any "new" guidance, it signals that the California AG is prioritizing breaches in the health care sector and serves as a reminder that entities subject to HIPAA are not exempt from California's more stringent breach notification requirements.

Instances of cybercrime against healthcare entities is likely to rise unless healthcare entities take reasonable precautions to protect their systems, devices, and networks from cyber threats. The federal government provides a number of resources related that help healthcare organizations harden their cybersecurity.