Employer Plans in OCR’s Crosshairs
June’s enforcement actions revealed a clear compliance message. The Office for Civil Rights (OCR) settled a HIPAA investigation with Spencer Gifts LLC Flexible Benefits and Welfare Benefit Plans for $450,000. This marks OCR’s 20th enforcement action related to ransomware incidents.
The investigation stemmed from a 2021 ransomware attack on the retailer’s network, which compromised the data of 10,023 plan members, including names, addresses, Social Security numbers, and phone numbers. OCR determined that the plan had failed to conduct a comprehensive risk analysis and did not have HIPAA-compliant policies in place before the breach occurred.
