HHS OCR Guidance On Ransomware Attacks: They Constitute A "Security Incident" And Are Likely A Data Breach

On July 11, 2016, the HHS Office of Civil Rights (OCR) released guidance on HIPAA covered entities' responsibilities in a ransomware attack, a type of cyber-attack that has targeted the health care sector extensively in recent months. This guidance comes in the wake of a June 20, 2016 "Dear Colleague" letter from HHS Secretary Sylvia Burwell highlighting ransomware issues. The most notable of OCR's statements is that ransomware attacks often constitute breaches subject to the HIPAA Breach Notification Rule.

Ransomware as Security Incident

OCR's guidance states that the presence of ransomware on a covered entity's or business associate's computer systems represents a "security incident" under the HIPAA Security Rule, as defined in 45 C.F.R. § 164.304.  HIPAA covered entities and business associates must develop and implement "reasonable and appropriate" response and reporting processes for security incidents such as ransomware attacks.  OCR advises that an