Health Data Privacy & Security: A Look Back At The Final Enforcement Push From HHS Under The Biden Administration

In the final days of the Biden Administration, the U.S. Department of Health and Human Services Office for Civil Rights ("HHS OCR") remained active in resolving a large number of investigations, reflecting the agency's noticeable recent productivity. In the past year, the HHS OCR has brought 22 HIPAA enforcement actions—the second-highest in HHS OCR history—and collected $9.9 million in settlements and civil penalties.

Several of the recent data security settlements have been part of HHS's recent focus on the risk analysis provision of the HIPAA Security Rule ("Security Rule"). The provision requires companies to "[c]onduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information ('ePHI') held by the covered entity or business associate." Since 2018, the HHS OCR has seen a 264% increase in reported large breaches involving ransomware, which may have