Spencer's Gifts LLC Flexible Benefits and Welfare Benefit Plans

The U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR) today announced a settlement with Spencer Gifts LLC Flexible Benefits and Welfare Benefit Plans (the Plan), the employer-sponsored group health plan of Spencer Gifts LLC, a national retail company, over potential violations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy and Security Rules. OCR enforces the HIPAA Privacy, Security, and Breach Notification Rules (HIPAA Rules), which set forth the requirements that covered entities (health plans, health care clearinghouses, and most health care providers), and business associates (collectively, regulated entities) must follow to protect the privacy and security of protected health information (PHI). The risk analysis provision of the HIPAA Security Rule requires regulated entities to conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic PHI (ePHI) held by those organizations. The settlement resolves an investigation that OCR initiated after the Plan filed a breach report on January 24, 2022. The Plan had received empl