You can see the full text of the most recent guidance here. The takeaway from HHS' guidance post WannaCry can be summarized as (1) Contingency Plans (see below); and (2) Network Scans.
My entity just experienced a cyber-attack! What do we do now?
A Quick-Response Checklist from the HHS, Office for Civil Rights (OCR)
Has your entity just experienced a ransomware attack or other cyber-related security incident, and you are wondering what to do now? This guide explains, in brief, the steps for a HIPAA covered entity or its business associate (the entity) to take in response to a cyber-related security incident. In the event of a cyber-attack or similar emergency an entity:
- Must execute its response and mitigation procedures and contingency plans...
- Should report the crime to other law enforcement agencies...
- Should report all cyber threat indicators to federal and information-sharing and analysis
organizations (ISAOs)... - Must report the breach to OCR as soon as possible, but no later than 60 days after the
discovery of a breach affecting 500 or more individuals...
OCR considers all mitigation efforts taken by the entity during in any particular breach investigation.
Such efforts include voluntary sharing of breach-related information with law enforcement agencies
and other federal and analysis organizations as described above.
Comments