On July 28, 2016, US Department of Health and Human Services
(HHS) issued guidance (guidance) under the Health Insurance
Portability and Accountability Act (HIPAA) on what covered entities
and business associates can do to prevent and recover from
ransomware attacks. Ransomware attacks can also trigger concerns
under state data breach notification laws.
The HIPAA Security Rule requires covered entities and business
associates to implement security measures. It also requires covered
entities and business associates to conduct an accurate and
thorough risk analysis of the potential risks and vulnerabilities
to the confidentiality, integrity and availability of electronic
protected health information (ePHI) the entities create, receive,
maintain or transmit and to implement security measures sufficient
to reduce those identified risks and vulnerabilities to a
reasonable and appropriate level. The HIPAA Security Rule
establishes a floor for the security of ePHI, although
