HHS Settles HIPAA Security Breach Stemming From Phishing Cyberattack For $3 Million

The Office for Civil Rights (OCR), a division of the U.S. Department of Health and Human Services (HHS), has announced a $3 million settlement with Solara Medical Supplies, LLC, a covered entity under the Health Insurance Portability and Accountability Act (HIPAA). The unauthorized disclosures stemmed from a cyberattack that resulted in violations of the HIPAA security and breach notification rules.

OCR began its investigation into the incident after Solara reported a phishing attack that led to a third party gaining access to eight employees' email accounts. The unauthorized email access resulted in the disclosure of the electronic protected health information (ePHI) of over 100,000 individuals, including personal identifying information such as driver's license numbers and Social Security numbers. The disclosed information also contained credit card, billing, and claims information.