HHS’ Office for Civil Rights Settles Second Ever Ransomware Cyber-Attack for $40,000 and a Corrective Action Plan with OCR Monitoring

HHS OCR announced a $40,000 settlement with Green Ridge Behavioral Health after a 2019 ransomware attack encrypted its network files and all patient EHRs, impacting over 14,000 individuals; the investigation found failures in risk analysis, risk mitigation, and activity monitoring, leading to a three-year corrective action plan, while OCR also highlighted broader surges in healthcare hacking and ransomware and recommended best practices such as risk management, audit controls, MFA, encryption, and workforce training.