Update: Regulator says Ransomware Infections Likely Reportable Under HIPAA

The Department of Health and Human Services issued guidance declaring that ransomware infections which encrypt or otherwise affect electronic protected health information (ePHI) generally constitute HIPAA reportable breaches; organizations must perform thorough analysis to prove a "low probability" of compromise or proceed with breach notifications, heightening regulatory and operational consequences for healthcare providers.