This article is part of a series of blog posts exploring the
recommendations and guidance Health & Human Services (HHS)
provides to healthcare organizations in its "Cybersecurity
Best Practices" report. For previous articles in the series,
click here.
The report on cybersecurity best practices
(Report) is not the first time HHS has discussed the prevalent
issue of ransomware attacks on healthcare entities. In 2016, HHS
issued its Ransomware Factsheet, which cited a 2016 U.S. government interagency report stating
that in the first six months of 2016, there were an average of
4,000 ransomware attacks every day, a 300 percent increase from
2015, when the daily average was 1,000 attacks. While this figure
was startling, perhaps the most impactful portion of the Factsheet
was HHS' position that "[w]hen [ePHI] is encrypted as a
result of a ransomware attack, a breach has occurred because the
ePHI encrypted by the ransomware was acquired[,] and thus is a
'disclosure' not
