New HHS Cybersecurity Preparedness Checklist

The Department of Health and Human Services' Office of Civil Rights (OCR) recently published a checklist to guide HIPAA-covered entities and business associates through an appropriate response to a ransomware or cybersecurity incident ("Incident"), as follows:

• respond to the Incident;
• mitigate any impermissible disclosure of protected health information;
• deploy contingency plans;
• report any cybercrime(s) to the appropriate law enforcement agency (e.g., the Federal Bureau of Investigation, Secret Service, state or local law enforcement); and
• report cyber-threats to applicable federal and information sharing and analysis organizations (ISAOs) (e.g., the Department of Homeland Security or the Health and Human Services Assistant Secretary for Preparedness and Response).