As ransomware incidents continue to target health plan data at an alarming rate, HIPAA Security Rule compliance has never been more critical for employer-sponsored group health plans. A recent resolution agreement between the U.S. Department of Health and Human Services (HHS) and an employer-sponsored group health plan resulted in a $245,000 payment and a comprehensive corrective action plan. This serves as a timely reminder that the Security Rule's requirements apply squarely to plan sponsors, not just healthcare providers. Let’s examine the key details of this enforcement action, walk through what the required risk analysis entails and share our perspective on what you should prioritize to stay ahead of the curve.
The HIPAA Security Rule
The HIPAA Security Rule sets standards for protecting electronic protected health information (ePHI) maintained by covered entities. These include certain healthcare providers, healthcare clearinghouses and health plans. Employer-sponsored group health plans are included among the health plan covered entities.
The Security Rule imposes several implementation specifications for HIPAA covered entities that are designated either as addressable or required. Covered entities must assess whether items listed as addressable are reasonable and appropriate for their circumstances. On the other hand, implementation specifications that are required must be included in the covered entity’s policies and procedures.
Risk analysis required
The risk analysis is a required implementation specification for covered entities to comply with the Security Rule. The HHS Office for Civil Rights (OCR) provides extensive guidance on the proper content and processes to establish and maintain a risk analysis. In short, the risk analysis requires the covered entity to conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of ePHI held by the covered entity.
New resolution agreement for employer-sponsored group health plan covered entity
HHS OCR recently investigated and settled four separate ransomware breaches under the Security Rule. Ransomware attacks generally attempt to deny access to data until a ransom is paid to receive a decryption key.
In one such investigation, HHS OCR entered into a resolution agreement with an employer-sponsored group health plan covered entity. The plan agreed to pay $245,000 to HHS after an investigation following a 2021 ransomware breach indicated the plan failed to conduct a risk analysis. The press release stated the ransomware attack exfiltrated ePHI from the self-funded plan’s information system that included names, addresses, dates of birth, SSNs and claims data of over 9,000 individuals.
The employer-sponsored group health plan covered entity also agreed to comply with a corrective action plan imposing a comprehensive security management process for ePHI.
How to comply with the required risk analysis implementation specification
HHS OCR guidance suggests as an example that covered entities consider the following steps to prepare a risk analysis:
- Identify the scope of the analysis
- Gather data
- Identify and document potential threats and vulnerabilities
- Assess current security measures
- Determine the likelihood of threat occurrence
- Determine the potential impact of threat occurrence
- Determine the level of risk
- Identify security measures and finalize documentation
Covered entities should also review the HHS OCR Guidance on Risk Analysis, as well as the National Institute of Standards and Technology publication titled Implementing the HIPAA Security Rule, A Cybersecurity Resource Guide. The Office of the National Coordinator for Health IT Security Risk Assessment Tool is primarily designed for healthcare providers. It isn't tailored to employer-sponsored group health plans.
Once completed, the information gleaned from the risk analysis is applied to evaluate, prioritize, modify and implement the covered entity’s risk management plan.
Key takeaways
Although HHS OCR investigations involving employer-sponsored group health plans are relatively uncommon, this resolution agreement provides an important reminder to remain engaged in the plan’s HIPAA compliance processes. The investigation’s focus on the risk analysis part is also worth noting because many employers haven't prioritized Security Rule compliance to the same degree as the Privacy Rule. This may need to shift given the current prevailing risks (including ransomware attacks) and enforcement environment.
In addition to the HIPAA Security Rule, you should also keep in mind that the Department of Labor recently issued a Compliance Assistance Release highlighting that employers have ERISA fiduciary duties to include cybersecurity matters as part of the process to prudently select and monitor health and welfare plan service providers.
How we can help
Our compliance practice delivers deep HIPAA expertise backed by a comprehensive assessment framework. As data breaches and ransomware incidents continue to escalate, we support plan sponsors in navigating complex HIPAA Security obligations and developing customized, audit‑ready risk analyses that align with current enforcement expectations.
Author
