SDOs & Operating Rules Updates

OCR Settles 8th Ransomware Investigation. The Office for Civil Rights (OCR) announced an $80,000 settlement with a Massachusetts company that provides electronic medical record and billing support services to HIPAA covered entities. The settlement resolves an investigation concerning a ransomware attack on the vendor’s information system.  On March 25, 2023, an unknown actor gained access to…

ASTP/ONC Publishes HTI-3 Final Rule on Reproductive Rights. The Assistant Secretary for Technology Policy, Office of the National Coordinator for Health It (ASTP/ONC) has published a final rule titled Health Data, Technology, and Interoperability: Protecting Care Access (HTI-3). The rule: (i) Finalized the addition of a definition of “reproductive health care” to the defined terms…

ASTP Publishes HTI-2 TEFCA Final Rule. The Assistant Secretary of Technology Policy (ASTP) published its Health Data, Technology, and Interoperability (HTI-2) Final Rule on the Trusted Exchange Framework and Common Agreement (TEFCA). ASTP states that HTI-2 Final Rule finalizes certain proposals related to TEFCA) from the HTI-2 Proposed Rule and seeks to advance interoperability and…

Several Key Health IT Rules Under Review by OMB. Several Health IT regulations are now under review by the Office of Management and Budget (OMB). Typically, review by OMB is the final stage before a regulation is published. Regulations under review include: “Proposed Modifications to the HIPAA Security Rule to Strengthen the Cybersecurity of Electronic…

OCR Settles HIPAA Ransomware Cybersecurity Investigation for $90,000. The Office for Civil Rights (OCR) announced a settlement with a provider of emergency medical services in Oklahoma for a potential violation of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Security Rule. The settlement resolves an investigation concerning a ransomware attack on the provider’s…

OCR Settles Ransomware Cybersecurity Investigation for $500,000. The Office for Civil Rights (OCR) announced a settlement with a plastic surgery practice in South Dakota for several potential violations of the HIPAA Security Rule, following an investigation into a ransomware attack breach. OCR initiated an investigation following the receipt of a breach report filed by the…