Assured Imaging

Today, the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR) announced a settlement with Assured Imaging (“Assured”) on behalf of Assured Imaging Affiliated Covered Entities, a medical imaging and screening service provider, concerning a potential violation of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Security Rule. Assured is a covered entity that provides services in Arizona, California, Georgia, , New Mexico, Nevada, New York, New Jersey, Pennsylvania, Texas, Oregon, and Washington . The settlement resolves an investigation that OCR initiated after receiving a breach report that Assured filed on August 27, 2020. Assured reported that on May 19, 2020, Assured discovered that a server on its network was infected with ransomware, impacting the PHI of over 244,000 patients. Affected PHI included patient names, addresses, dates of birth, diagnosis and conditions, lab results, medications, and treatment information. OCR’s investigation determined that Assured had impermissibly disclosed PHI, failed to conduct an accurate and thorough risk analysis to determine the potential risks and vulnerabilities to the confidentiality,