Top of the World Ranch Treatment Center

The U.S. Department of Health and Human Services, Office for Civil Rights (OCR) today announced a settlement of $103,000 in an investigation of Top of the World Ranch Treatment Center (TWRTC), a substance abuse disorder treatment provider, concerning a potential violation of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Security Rule’s Risk Analysis provision. OCR enforces the HIPAA Privacy, Security, and Breach Notification Rules. The Risk Analysis provision of the Security Rule requires a regulated entity to conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information (ePHI) held by that entity. The Breach Notification Rule requires HIPAA covered entities and their business associates to provide notification following a breach of unsecured protected health information (PHI). TWRTC detected a phishing attack, in which an unauthorized third party accessed a workforce member’s email account. TWRTC reported to OCR that it engaged a third-party forensic firm to assist with securing the account and investigating the extent of unauthorized ac