May 27, 2022

Volume XII, Number 147

Advertisement
Advertisement

May 26, 2022

Subscribe to Latest Legal News and Analysis

May 25, 2022

Subscribe to Latest Legal News and Analysis

May 24, 2022

Subscribe to Latest Legal News and Analysis

New Jersey Settles with Cancer Center Over Business Email Compromise

One of the challenging things about HIPAA (Health Insurance Portability and Accountability Act) enforcement is the fact that both the Office for Civil Rights and State AGs have jurisdiction to assess fines and penalties for HIPAA violations. The old double whammy.

States enforce those rights sparingly, but New Jersey is getting itself on the map by enforcing HIPAA and assessing fines and penalties and/or settling with entities for alleged HIPAA violations. This year, it has already racked up several settlements with companies over alleged violations of both state law and HIPAA.

The most recent settlement involved a case that stemmed from a business email compromise (BEC) incident in which several Regional Cancer Care Associates’ email accounts were compromised through a targeted phishing campaign and the employees disclosed their credentials to a threat actor. As a result of the BEC, the protected health information of more than 105,000 individuals was compromised, including names, addresses, driver’s license numbers, and Social Security numbers.

More than 80,000 of the affected individuals reside in New Jersey, hence the interest of the New Jersey Division of Consumer Affairs (Division) in the AG’s office. The Division alleged violations of both the New Jersey Consumer Fraud Act and HIPAA. According to Acting Attorney General Bruck when announcing the settlement, “New Jerseyans battling cancer should never have to worry about whether their medical providers are properly securing and protecting their personal information from cyber threats. We require healthcare providers to implement adequate security measures to protect patient data, and we will continue to hold accountable companies that fall short.”

Note to covered entities and business associates in New Jersey: your AG is active in this space, so dusting off your HIPAA compliance program and Written Information Security Program might be a high priority for the new year.

Copyright © 2022 Robinson & Cole LLP. All rights reserved.National Law Review, Volume XI, Number 357
Advertisement
Advertisement
Advertisement
Advertisement
Advertisement
Advertisement

About this Author

Linn F. Freedman, Robinson Cole Law Firm, Cybersecurity and Litigation Law Attorney, Providence
Partner

Linn Freedman practices in data privacy and security law, cybersecurity, and complex litigation. She provides guidance on data privacy and cybersecurity compliance to a full range of public and private clients across all industries, such as construction, education, health care, insurance, manufacturing, real estate, utilities and critical infrastructure, marine, and charitable organizations. Linn is a member of the firm's Business Litigation Group and chairs its Data Privacy + Cybersecurity Team. She is also a member of the Financial Services Cyber-Compliance Team (CyFi ...

401-709-3353
Advertisement
Advertisement
Advertisement