Privacy & Information Security Law Blog

As reported in BNA Privacy Law Watch, on December 6, 2017, health care provider 21st Century Oncology agreed to pay $2.3 million to settle charges by the Department of Health and Human Services' (“HHS”) Office for Civil Rights (“OCR”) that its security practices led to a data breach involving patient information. The settlement was made public in the company’s December 6, 2017, bankruptcy filing. The HHS charges stemmed from a 2015 data breach involving the compromise of Social Security numbers, medical diagnoses and health insurance information of at least 2.2 million patients. OCR found that 21st Century Oncology failed to perform risk assessments on its systems or implement effective security protocols to protect patient information. As part of the settlement, 21st Century Oncology did not admit liability but did agree, in addition to the $2.3 million payment, to undertake a revision of its information security policies and procedures and to implement certain information security measures, including risk assessments.