UHG/Change Health Breach Highlights Health Plan Cyber-Related Duties


The sweeping threat risk ransomware attacks present for health plans, their fiduciaries, business associate and other service providers, employer and other plan sponsors and their participants and beneficiaries is driven home by the disclosure of United Health Group (“UHG”) subsidiary Change Health to the Department of Health and Human Services (“HHS”) Office of Civil Rights (“OCR”) that it now has sent approximately 100 million individuals individual breach notifications that the February 21, 2024, Blackcat 1234 ransomware attack Change Health experienced impacted their electronic personal health information (“ePHI”). With health plans particularly exposed to the rising epidemic of ransomware threats, health plans, their fiduciaries, employer and other health plan sponsors and service providers face growing imperatives to tighten up both their compliance and risk management against these cyber threats.

Health Plans, Their Fiduciaries, Sponsors and Service Providers Face Health Plan Related Cybersecurity Responsibilities & Risks

The UHG Change Health breach and its evolving fallout provides a timely reminder to health plans and insurers, their fiduciaries, plan sponsors, vendors and leaders to ensure their own timely and prudent steps both to respond to fallout from the UHG breach as well as to prevent, prepare for and respond to other future cyber threats direct threats to their own data and systems as well as indirect threats arising from ransomware, malware and other cyber events affecting business associates and other service providers, the plan sponsor, health care providers and other third party systems and data interfacing with their own systems and data.

Health plans and their business associate service providers face detailed responsibilities to prevent access, use, disclosure or destruction of electronic (“ePHI”) and other personally identifiable information (“PHI”) except as allowed by the Health Insurance Portability and Accountability Act (“HIPAA”) and to notify individuals of breaches of their ePHI in accordance with HIPAA’s breach notification rules. As part of these rules, HIPAA also restricts the circumstances that health plans legally can allow employers or their representatives to access or use health plan PHI without a HIPAA-compliant authorization from the applicable individual. The months-long delay in Change Health’s ability to identify the individuals whose ePHI was impacted by the February 21, 2024, breach demonstrates the challenges that ransomware and other malware attacks to their own or their party systems can create for health plans, their fiduciaries and business associates in fulfilling these obligations as well as carrying out other critical plan functions. Aside from dealing with the immediate demands created by the breach, the Change Health breach and other similar events are the type of events that prompt an obligation under the HIPAA Security Rule for health plans and other HIPAA-covered entities to review and update their documented HIPAA Security Risk analyses and resulting safeguards for protecting the destruction, loss of use, unauthorized use or disclosure and other HIPAA required safeguards against future ransomware or other threats. Health plans and their fiduciaries should consult with experienced legal counsel about recommended processes for conducting and documenting this updated analysis.

Beyond these HIPAA mandates, the disruptions to health plan data and operations experienced by many health plans as a result of the UHG/Change Health breach also puts health plan on notice of the potential need for health plans, their fiduciaries and service providers to conduct a documented, prudent analysis of their health plan security, backup and recovery, and other systems to both protect ePHI and other sensitive health plan data and systems from unauthorized destruction, access, and disclosure that could disrupt health plan operations, allow use or disclosure of plan information other than for the exclusive benefit of the health plan, its participants and beneficiaries or both under fiduciary responsibility rules of the Employee Retirement Income Security Act (“ERISA”).

In weighing their fiduciary responsibility to safeguard the health plan, its data and systems against ransomware, malware and other cybersecurity threats, health plans and their fiduciaries should keep in mind that the Department of Labor Employee Benefit Security Administration (“EBSA”) interprets the prudence, exclusive benefit and other ERISA fiduciary responsibility requirements as applying to PHI, financial, and other health plan data and systems. As part of these discretion, or control (“fiduciaries”) generally should take documented steps to ensure their ability to defend the prudence of their efforts to protect health plan data and systems including:

  • To prevent disruptions to health plan systems and data from malware or other malicious or other events experienced by their health plan and its sponsors, service providers, and other third parties interfacing with health plan systems that could disrupt health plan enrollment, claims and appeals or other operations as well as against access, use or disclosure except as legally allowed for the exclusive benefit of the health plan participants and beneficiaries and in accordance with HIPAA;
  • To implement and administer appropriate contractual, audit, oversight, notification, cyber liability and other coverage and indemnification and other arrangements with business associates and other third parties whose interactions with the health plan create threats to the integrity and security of health plan systems and operations;
  • To plan and implement appropriate insurance, indemnity and other arrangement to pay for prudent investigations and other responses necessary to a known or suspected threat or breach impacting its health plan administration, data and systems;
  • To plan and implement appropriate monitoring, notification, investigation, response and recovery arrangements to position the health plan to resume and continue timely administration of health plan enrollment, claims, appeals and other operations in the event the health plan or its service providers are impacted by a cybersecurity or other event that impacts health plan data or administrative systems;
  • To ensure timely monitoring, notification and response to cyber and other threats to its systems and data to protect the health plan and its participants and beneficiaries from damages arising from cybersecurity and other threats to its systems and data;
  • To communicate prudently with participants, beneficiaries and others regarding cybersecurity and other events impacting the security of data and systems; and
  • To act prudently to ensure adequate monitoring and response to cybersecurity and other threats to health plan data and systems to prevent and mitigate disruptions to health plan data and systems that could disrupt the orderly and timely administration of their health plan.

Change Health/UHG Breach Highlights Health Plan Cyber Threats & Exposures

The sweeping disruptions to health plan and other operations arising from the UHG/Change Health ransomware attack graphically illustrate how malware and other cyber incidents can trigger catastrophic disruptions in health plan and other health industry operations whether experienced directly by the health plan or from the indirect effects of a cybersecurity event experienced by a third-party interfacing with the health plan.

Health plans are particularly at risk from ransomware, malware and other hacking threats. OCR breach reports confirm ransomware and hacking present the largest cyber-threats for health plans and health care providers. While most OCR HIPAA resolution agreements have involved health care providers, the largest HIPAA breaches and resulting HIPAA resolution payments to date have involved health insurers and their health plans.

Ransomware, hacking and other cyber risks present significant and growing threats to health plans and health care providers. Over the past five years, there has been a 256% increase in large breaches reported to OCR involving hacking and a 264% increase in ransomware. In 2023, hacking accounted for 79% of the large breaches reported to OCR. The large breaches reported in 2023 affected over 134 million individuals, a 141% increase from 2022.

The UHG breach demonstrates ransomware and other breaches can have sweeping liability and operational disruptions that extend beyond the original victim and include but are rarely limited to HIPAA penalties.

In response to the growing threat revealed by this data, OCR increasingly has urged health plans and other covered entities to protect their data and systems against ransomware and other cyberattacks. Choice Health/UHG attack occurred just days after OCR announced the second of two HIPAA resolution agreements since October as well as published a series of other guidance warning covered entities and their business associates to guard against ransomware and other cybersecurity threats as part of their HIPAA obligations prompted by concern over exploding threats.

Historically, most health plans, their sponsors, fiduciaries, and business associates assumed they could rely upon their insurers or other service providers to handle breaches experienced by that vendor impacting their health plans or members. However, OCR HIPAA and EBSA ERISA guidance reflects that health plans and plan fiduciaries need to take prompt documented actions before, during and after an insurer or other plan administrative services provider experiences a cybersecurity incident.

While UHG struggles to recover and defend its actions before Congress, regulators, customers, plan members and patients, providers and others, health plans, their sponsors, fiduciaries, and vendor business associates need to ensure their ability to demonstrate and defend the adequacy of their own breach protections, response, and other compliance.

HIPAA Security & Breach Notification Responsibilities

While most health plans, their sponsors, fiduciaries and vendors expect Change Health and other UHG entities know UHG bears breach notification and other HIPAA responsibilities and to incur liabilities under HIPAA and other federal and state data privacy and cybersecurity laws, many health plan fiduciaries, sponsors, insurers, and administrative or other service providers don’t understand their own responsibilities to prevent and respond to the UHG and other cyber events potentially impacting their health plans under HIPAA. 

Guidance published by the U.S. Department of Health and Human Services Office for Civil Rights (OCR) on March 13, 2023, alerts health plans and health insurers, their fiduciaries and plan sponsors, health care providers, health care clearinghouses, and their business associates (covered entities) against overlooking their own potential HIPAA responsibilities arising from the February 21 Choice Health attack or other similar events.

HIPAA requires covered entities and their business associates to protect the privacy and security of protected health information, to have and enforce HIPAA-compliant business associate agreements, to conduct timely documented risk assessments in response to known or foreseeable security threats, and to provide notice of a breach to OCR, affected individuals and for breaches affecting more than 500 individuals. This responsibility includes both protecting protected health information from unauthorized use or disclosure, as well as to prevent it from improper destruction or unavailability such as can result from a ransomware attack or other disaster.

Under the HIPAA Security Rule, covered entities must conduct documented risk assessments to evaluate and monitor their electronic personal health information (EPHI) and associated systems for potential breaches and other threats that expose EPHA to unauthorized use, access, disclosure, destruction or other compromise.

To fulfill this requirement, the Security Rule requires covered entities and business associates to conduct documented risk assessments impacting their EPHI and to update these risk assessments in response to internal or external events impacting the adequacy of their risk assessments or security safeguards.

While the responsibility of covered entities and business associates to protect EPHI against unauthorized use, access and disclosure from cybercriminals and others receives the most attention, the Security Rule also includes often less discussed responsibility to protect EPHI and related operating systems against destruction or other disruptions from a wide range of threats including ransomware attacks. 

OCR guidance makes clear that OCR views safeguarding EPHI against ransomware and other cybersecurity threats as encompassed in this duty.  As part of these efforts, OCR and other cybersecurity agencies have recommended among other things that covered entities and business associates:

  • Routinely take inventory of assets and data to identify authorized and unauthorized devices and software;
  • Prioritize remediation of known exploited vulnerabilities’
  • Enable and enforce multifactor authentication with strong passwords;
  • Close unused ports and remove applications not deemed necessary for day-to-day operations.

 See e.g., #StopRansomware: ALPHV Blackcat | CISA.

Furthermore, when a breach of results in an unauthorized use, access, disclosure or destruction of EPHI, the HIPAA Breach Notification Rule requires covered entities and their business associates to provide timely notification of the breach to subjects of the breached EPHI and OCR, and if the breach affects more than 500 subjects, to the media.  Concurrently, the HIPAA Security Rule requires health plans and other covered entities to evaluate through documented risk assessments and take appropriate timely action to update their EPHI security as necessary to respond to breaches, potential breaches and other evolving threats to their EPHI and related systems. 

On March 13, 2024, the Office of Civil Rights (OCR) released a “Dear Colleague letter” that warns the February 21, 2024 CH/UHG data breach is likely to trigger HIPAA obligations and investigations for Choice Health and UHG as well as other HIPAA-covered health plans, heath care providers, heath care clearinghouses and business associates.  While stating the investigation currently focuses on Change Healthcare and UHC, for instance, the Dear Colleague Letter warns that OCR anticipates that its response to the February 21, 2024 CH/UHG Attack eventually also will include “secondary” investigations of other health plans, health care providers, health care clearinghouses and business associates “tied to or impacted by this attack.”

In light of these anticipated secondary investigations, OCR’s Dear Colleague letter warns health plans, health care providers, health care clearinghouses, business associates to ensure they timely and properly handle their own potential HIPAA responsibilities arising from the CH/UHG Attack.  The Dear Colleague letter expressly alerts health plans, health care providers and other covered entities and business associates “that have partnered with Change Healthcare and UHG” in anticipation of OCR’s expected secondary investigations to ensure that their own ability to demonstrate their organization meet all required HIPAA responsibilities including that:

  • All required “business associate agreements are in place;
  • All required breach notifications are provided to HHS, affected persons and in the event of a large breach affecting more than 500 individuals, to the media; and
  • All security and other HIPAA responsibilities are met.

The Dear Colleague Letter also directed covered entities and their business associates to the following previously released OCR resources for assistance in understanding their responsibilities for guarding EPHI against ransomware and other cybersecurity threats:

  • The OCR HIPAA Security Rule Guidance Material webpage;
  • OCR Video on How the HIPAA Security Rule Protects Against Cyberattacks;
  • OCR Webinar on HIPAA Security Rule Risk Analysis Requirement;
  • HHS Security Risk Assessment Tool;
  • Factsheet: Ransomware and HIPAA; and
  • Healthcare and Public Health (HPH) Cybersecurity Performance Goals.

Standing alone, the Dear Colleague Letter makes clear that all covered entities partnered with or impacted by disruptions from the CH/UHG attack need to take documented steps to reevaluate and tighten the adequacy of their existing security safeguards as well as their processes for monitoring and responding to evolving ransomware and other cybersecurity threats in anticipation of becoming the target of potential “secondary” OCR investigations arising from the CH/UHG Attack.

While the Dear Colleague Letter specifically references covered entities and business associates “partnered” with Choice Health, OCR’s previously issued guidance warning all covered entities and their business associates to safeguard their EPHI against ransomware and other cybersecurity threats, strongly suggest that all covered entities and business associates should consider the advisability of reevaluating the adequacy of their own EPHI safeguards in light of the heightened ransomware and other cyber threat illustrated by the CH/UHG Attack.  Consequently, all covered entities and business associates partnered with or impacted by the CH/UHG Attack or its resulting distributions specifically, as well as covered entities and business associates generally should work with experienced legal counsel to conduct documented risk assessments of their systems, exposures, responsibilities and risks taking into account these developments as soon as possible in anticipation of complaint or audit driven investigations arising from the Choice Health and other malware events and threats.

Health Plan Data Security & Breach Related ERISA Duties

In addition to any applicable HIPAA responsibilities, fiduciaries and sponsors of employer or union sponsored health plans subject to the Employee Retirement Income Security Act (ERISA) also should consider whether the CH/UHG Attack or the heightened ransomware and other cyber security threats any additional actions are prudently necessary to protect the health plan data, assets or operations.

ERISA generally requires individuals or entities named as fiduciaries or otherwise possessing functional discretionary authority or responsibility or authority over a plan or its assets (fiduciaries) to act prudently to protect and administer the plan and its assets.  Department of Labor Employee Benefit Security Administration (EBSA) guidance published in April, 2021 first officially confirmed its interpretation of ERISA’s duty of prudence as including a duty to utilize prudent cybersecurity safeguards.  Since EBSA published this cybersecurity guidance EBSA also has also added cybersecurity inquiries to its plan fiduciary audits. As a result, in addition to complying with HIPAA, ERISA-covered health plan fiduciaries and sponsors also should be prepared to demonstrate plan fiduciaries acted prudently to comply with HIPAA as well as the following actions to safeguard health and other employee benefit plan data and systems against cybersecurity threats:

  • Tips for Hiring a Service Provider: Helps plan sponsors and fiduciaries prudently select a service provider with strong cybersecurity practices and monitor their activities, as ERISA requires.
  • Cybersecurity Program Best Practices: Assists plan fiduciaries and record-keepers in their responsibilities to manage cybersecurity risks.
  • Online Security Tips: Offers plan participants and beneficiaries who check their retirement accounts online basic rules to reduce the risk of fraud and loss.

In light of this OCR and EBSA guidance, health plan sponsors, fiduciaries and vendors and other HIPAA covered entities and business associates are urged to take documented steps to audit and strengthen as needed their safeguards against hacking and other cybersecurity threats including:

  • In the case of any health plan or health plan vendor, taking well documented steps to assess and tighten as necessary their health plan systems and data security to meet or exceed the recommendation outlined in the EBSA cybersecurity guidance or otherwise necessary to prudently guard their plans and plan data and systems against cybersecurity threats.
  • Reviewing and monitoring on a documented, ongoing basis the adequacy and susceptibilities of existing practices, policies, safeguards of their own organizations, as well as their business associates and their vendors within the scope of attorney-client privilege taking into consideration data available from OCR, data regarding known or potential susceptibilities within their own operations as well as in the media, and other developments to determine if additional steps are necessary or advisable.
  • Updating policies, privacy and other notices, practices, procedures, training and other practices as needed to promote compliance and defensibility.
  • Renegotiating and enhancing service provider agreements to detail the specific compliance, audit, oversight and reporting rights, workforce and vendor credentialing and access control, indemnification, insurance, cooperation and other rights and responsibilities of all entities and individuals that use, access or disclose, or provide systems, software or other services or tools that could impact on security; to clarify the respective rights, procedures and responsibilities of each party in regards to compliance audits, investigation, breach reporting, and mitigation; and other relevant matters.
  • Verifying and tightening technological and other tracking, documentation and safeguards and controls to the use, access and disclosure of protected health information and systems.
  • Conducting well-documented training as necessary to ensure that members of the workforce of each covered entity and business associate understand and are prepared to comply with the expanded requirements of HIPAA, understand their responsibilities and appropriate procedures for reporting and investigating potential breaches or other compliance concerns, and understand as well as are prepared to follow appropriate procedures for reporting and responding to suspected
    violations or other indicia of potential security concerns.
  • Tracking and reviewing on a systemized, well-documented basis actual and near miss security threats to evaluate, document decision-making and make timely adjustments to policies, practices, training, safeguards and other compliance components as necessary to identify and resolve risks.
  • Establishing and providing well-documented monitoring of compliance that includes board level oversight and reporting at least quarterly and sooner in response to potential threat indicators.
  • Establishing and providing well-documented timely investigation and redress of reported
    violations or other compliance concerns.
  • Establishing contingency plans for responding in the event of a breach. 
  • Establishing a well-documented process for monitoring and updating policies, practices and other efforts in response to changes in risks, practices and requirements.
  • Preparing and maintaining a well-documented record of compliance, risk, investigation and other security activities.
  • Pursuing other appropriate strategies to enhance the covered entity’s ability to demonstrate its compliance commitment both on paper and in operation.

Because susceptibilities in systems, software and other vendors of business associates, covered entities and their business associates should use care to assess and manage business associate and other vendor associated risks and compliance as well as tighten business associate and other service agreements to promote the improved cooperation, coordination, management and oversight required to comply with the new breach notification and other HIPAA requirements by specifically mapping out these details.

Furthermore, while the preemption provisions of ERISA generally insulate health plans and their sponsors from responsibility or liability for complying with state insurance, data security, breach notification or other state law cybersecurity and cyber breach and breach notification laws and rules, health insurers and other health plan service providers generally remain subject to these state law requirements.  Consequently, health insurers, administrative service providers and other health plan vendors also should act promptly to evaluate and ensure their fulfillment of all applicable cybersecurity and data breach mandates under relevant state law.

Leaders of covered entities or their business associates also are cautioned that while HIPAA itself does not generally create any private right of action for victims of breach under HIPAA, breaches may create substantial liability for their organizations or increasingly, organizational leaders under state data privacy and breach, negligence or other statutory or common laws.  In addition, physicians and other licensed parties may face professional discipline or other professional liability for breaches violating statutory or ethical standards.  Meanwhile, the Securities and Exchange Commission has indicated that it plans to pursue enforcement against leaders of public health care or other companies that fail to use appropriate care to ensure their organizations comply with privacy and data security obligations and the Employee Benefit Security Administration recently has issued guidance recognizing prudent data security practices as part of the fiduciary obligations of health plans and their fiduciaries.

Health plans and other covered entities are reminded that appropriate strategic planning and use of attorney-client privilege and other evidentiary tools can critically impact the defensibility of pre-breach, breach investigation and post-breach investigation and decision-making. Because HIPAA, EBSA and other rules typically require prompt investigation and response to known or suspected hacking or other cybersecurity threats, health plans and other covered entities or business associates should seek the assistance of experienced legal counsel to advise and assist in these activities to understand the potential availability and proper use of these and other evidentiary rules as part of the compliance planning process as well as to prepare for appropriate use in the event of a known or suspected incident to avoid unintentional compromise of these protections.

ERISA & Other Risks From Untimely Timely Acceptance & Processing of Health Plan Eligibility & Benefit Provisions

Since Change Health shut down its tools and systems CH/UHG Attack has created and continues to cause nationwide disruptions in the ability of pharmacy, physician and other health care providers to submit, and health plans and insurers to receive and process a wide range of health care billing, claims and other transactions because of the widespread integration and use of Choice Health tools in systems health care providers and payers use for the submission, receipt, and processing of health care provider eligibility, billing and other health benefits.  

Along with the liabilities and headaches that the ransomware attack and resulting disruptions create for Choice Healthcare and UHG, delays and other disruptions in the handling of health benefit eligibility, claims processing, notifications and payment by health plans and their administrative services providers arising from can create a host of additional liability headaches health plans, health insurers, their fiduciaries and administrative services providers in addition to those arising directly from the HIPAA and other cybersecurity breach itself.

For ERISA-covered health plans, ERISA generally holds health plans and their fiduciaries accountable for the prudent, timely administration of health plan eligibility, claims and other administrative functions in accordance with the terms of the plan and within the applicable time frames and other requirements of ERISA’s reasonable claims procedure and adverse benefit determination rules.  Health plans and their ERISA plan administrators generally must receive and process claims transactions required by the adverse claim determination regulations and provide participants or beneficiaries with detailed written notifications for any claims not processed and paid within the relevant 72-hour, 15-day or 30-day time period specified by the adverse claim determination rules.  Noncompliance with these requirements both undermines the defensibility of the health plan’s denial of coverage and subjects the plan administrator to liability for EBSA penalties and/or discretionary awards of penalties plus attorneys’ fees and other costs of enforcement to plan participants or beneficiaries for failures to deliver timely notification of the denial.  To the extent that EBSA or a court determines that the failure to timely and appropriately process and pay benefits resulted from a lack of prudence or other breach of ERISA fiduciary duties, fiduciaries are at risk for incurring personal liability for actual damages to the plan or its participants plus attorneys’ fees and other costs of enforcement; EBSA penalties for engaging in a breach of fiduciary duty under ERISA section 502(l); or both.

Beyond these ERISA-related risks, delays in processing and payment of health care provider claims also create potential additional liability for health insurers, health plans and their administrators to the extent the disruptions prevent the timely payment and processing of health benefit claims in violation of health care provider rights under managed care or other provider contracts, prompt pay and surprise billing or other provider legal rights.  Unlike member claims assigned to providers, ERISA generally does not preempt these nonderivative provider rights and claims or the additional state law damages, penalties or other remedies arising under state law against health insurers, health plans and plan administrators found to violate these rules. Consequently, delays in payments to providers also could substantially increase the costs and liabilities that health insurers, health plans, their fiduciaries, administrators, and employers and other sponsors obligated under the plan terms or vendor contracts to pay these costs.

In light of these and other potential risks, health insurers and health plans, their employer, union and other sponsors, fiduciaries, administrative services providers and other vendors should act quickly to investigate and ensure proper management of the fallout from the CH/UHG Attack and the heightened ransomware and other cybersecurity threats it represents.

Along with working with qualified legal counsel to address the potential HIPAA, ERISA and other responsibilities the health plan or insurer, its fiduciaries, service providers and sponsor bear from the CH/UHG Attack and other cyber risks, most parties also will want to evaluate obligations to notify cybersecurity and other liability insurers, seek indemnification from Choice Healthcare, UHG or other potentially culpable parties and evaluate other sensitive data and strategies for mitigation of their health plan and their own resulting liabilities, costs and other consequences.

For Additional Information

We hope this update is helpful. Solutions Law Press, Inc. invites you to receive future updates by registering on  here and participating and contributing to the discussions in our Solutions Law Press, Inc. LinkedIn SLP Health Care Risk Management & Operations Group, HR & Benefits Update Compliance Group, and/or Coalition for Responsible Health Care Policy.

If you need have questions or need assistance with this or other cybersecurity, health, benefit, payroll, investment or other data, systems or other privacy or security related risk management, compliance, enforcement or management concerns, to inquire about arranging for compliance audit or training, or need legal representation on other matters,  contact the author Cynthia Marcotte Stamer via e-mail or via telephone at (214) 452 -8297. 

About the Author 

Cynthia Marcotte Stamer is a practicing attorney board certified in labor and employment law by the Texas Board of Legal Specialization and management consultant, author, public policy advocate and lecturer widely known for 35 plus years of health and other benefit, health care and other management work, public policy leadership and advocacy, coaching, teachings, and publications.

Ms. Stamer is widely recognized and sought out for her knowledge and experience on health, employee benefits and other privacy and security. Ms. Stamer’s work throughout her career has focused heavily on working with health care and managed care, life sciences, health and other employee benefit plan, insurance and financial services and other public and private organizations and their technology, data, and other service providers and advisors domestically and internationally with legal and operational compliance and risk management, performance and workforce management, regulatory and public policy and other legal and operational concerns.

A Fellow in the American College of Employee Benefit Counsel, Scribe for the Co-Chair of the American Bar Association (“ABA”) JCEB Annual Agency Meeting with HHS-OCR, ABA International Section Life Sciences and Health Committee and Vice-Chair and Chair Elect of its International Employment Law Committee, Chair of the ABA TIPS Section Medicine & Law Committee, Past Chair of the ABA Managed Care & Insurance Interest Group Chair of the ABA RPTE Employee Benefits & Other Compensation Group and current co-Chair of its Welfare Benefit Committee, and Chair of the ABA Intellectual Property Section Law Practice Management Committee and author of a multitude of highly-regarded publications on HIPAA and other cybersecurity, privacy, technology, employee benefits and health care publications, Ms. Stamer is most widely recognized for her decades of pragmatic, leading-edge work, scholarship and thought leadership on heath benefit and other healthcare and life science, managed care and insurance and other workforce and staffing, employee benefits, safety, contracting, quality assurance, compliance and risk management, and other legal, public policy and operational concerns in the healthcare and life sciences, employee benefits, managed care and insurance, technology and other related industries. She speaks and publishes extensively on these and other related compliance issues.

Author of a multitude of highly regarded publications on HIPAA and other medical record and data privacy and scribe for the ABA JCEB Annual Meeting with the HHS Office of Civil Rights, her experience includes extensive involvement throughout her career in advising health care and life sciences and other clients about preventing, investigating and defending EEOC, DOJ, OFCCP and other Civil Rights Act, Section 1557 and other HHS, HUD, banking, and other federal and state discrimination investigations, audits, lawsuits and other enforcement actions as well as advocacy before Congress and regulators regarding federal and state equal opportunity, equity and other laws. 

For more information about Ms. Stamer or her health industry and other experience and involvements, see www.cynthiastamer.com or contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here. 

About Solutions Laws Press, Inc.™

Solutions Law Press, Inc.™ provides human resources and employee benefit and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education on leadership, governance, human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also be interested in reviewing some of our other Solutions Law Press, Inc.™ resources available here, such as:

OCR’s warning and referencing of these resources strongly signals that OCR will hold health plans and business associates targeted for OCR investigation after experiencing or being impacted by a breach to demonstrate their fulfillment of these and other requirements. Accordingly, given OCR’s Letter and the continued heightened ransomware and other cyber security risk, health plans and other covered entities and business associates, their fiduciaries, sponsors, and vendors whether or not partnered with or impacted by the Choice Health/UHG should work with experienced legal counsel to conduct documented risk assessments of their systems, exposures, responsibilities and risks taking into account these developments as soon as possible in anticipation of complaint or audit driven investigations due to he UHG/Choice Health and other ransomware, malware and cybersecurity events and threats.

Based on existing OCR guidance, Choice Health/UHG and other known and evolving ransomware and other cyber attacks almost certainly warrant the need for those partnered or impacted by the breach to conduct documented, evaluations of the need to provide breach notification, as well as updated risk assessments. Moreover, given the widespread and continuing exposure to ransom and other cyber security risks referenced in the OCR and other reports, even those covered entities not partnered or impacted also need to conduct updated risk assessments based on the notifications of emerging risks, highlighted by that breach.

Along with updating risk assessments and resulting safeguards, covered entities, and business associates also clearly should ensure that they have and are enforcing up-to-date, business associate agreements, privacy practices and policies, and cyber threat monitoring, defense and response.impacted health plans, their employer and other sponsors, fiduciaries and business associates also should ask legal counsel about the availability of and notification and other requirements to qualify for indemnity or liability insurance coverage of breach-related claims and other options to mitigate or recover liabilities and costs arising from these and other breaches.

For More Information

We hope this update is helpful. For more information about these or other health or other legal, management, or public policy developments, please get in touch with the author Cynthia Marcotte Stamer via e-mail or via telephone at (214) 452 -8297. 

Solutions Law Press, Inc. invites you to receive future updates by registering on our Solutions Law Press, Inc. Website and participating and contributing to the discussions in our Solutions Law Press, Inc. LinkedIn SLP Health Care Risk Management & Operations Group, HR & Benefits Update Compliance Group, and/or Coalition for Responsible Health Care Policy

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.

About the Author 

R Cynthia Marcotte Stamer is a practicing attorney board certified in labor and employment law by the Texas Board of Legal Specialization and management consultant, author, public policy advocate and lecturer widely known for 35 plus years of health industry and other management work, public policy leadership and advocacy, coaching, teachings, and publications.

A Fellow in the American College of Employee Benefit Counsel, Co-Chair of the American Bar Association (“ABA”) International Section Life Sciences and Health Committee and Vice-Chair Elect of its International Employment Law Committee, Chair-Elect of the ABA TIPS Section Medicine & Law Committee, Past Chair of the ABA Managed Care & Insurance Interest Group, Scribe for the ABA JCEB Annual Agency Meeting with HHS-OCR, past chair of the ABA RPTE Employee Benefits & Other Compensation Group and current co-Chair of its Welfare Benefit Committee, and Chair of the ABA Intellectual Property Section Law Practice Management Committee, Ms. Stamer is most widely recognized for her decades of pragmatic, leading-edge work, scholarship and thought leadership on heath benefit and other healthcare and life science, managed care and insurance and other workforce and staffing, employee benefits, safety, contracting, quality assurance, compliance and risk management, and other legal, public policy and operational concerns in the healthcare and life sciences, employee benefits, managed care and insurance, technology and other related industries. She speaks and publishes extensively on these and other related compliance issues.

Ms. Stamer’s work throughout her career has focused heavily on working with health care and managed care, life sciences, health and other employee benefit plan, insurance and financial services and other public and private organizations and their technology, data, and other service providers and advisors domestically and internationally with legal and operational compliance and risk management, performance and workforce management, regulatory and public policy and other legal and operational concerns. Author of a multitude of highly regarded publications on HIPAA and other medical record and data privacy and scribe for the ABA JCEB Annual Meeting with the HHS Office of Civil Rights, her experience includes extensive involvement throughout her career in advising health care and life sciences and other clients about preventing, investigating and defending EEOC, DOJ, OFCCP and other Civil Rights Act, Section 1557 and other HHS, HUD, banking, and other federal and state discrimination investigations, audits, lawsuits and other enforcement actions as well as advocacy before Congress and regulators regarding federal and state equal opportunity, equity and other laws. 

For more information about Ms. Stamer or her health industry and other experience and involvements, see www.cynthiastamer.com or contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here. 

About Solutions Laws Press, Inc.™

Solutions Law Press, Inc.™ provides human resources and employee benefit and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education on leadership, governance, human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also be interested in reviewing some of our other Solutions Law Press, Inc.™ resources available here, such as:

IMPORTANT NOTICE ABOUT THIS COMMUNICATION

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.

NOTICE: These statements and materials are for general informational and educational purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation in light of the specific facts and circumstances presented in their unique circumstances at any particular time. No comment or statement in this publication is to be construed as legal advice or an admission. The author and Solutions Law Press, Inc.™ reserve the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law is rapidly evolving and rapidly evolving rules make it highly likely that subsequent developments could impact the currency and completeness of this discussion. The author and Solutions Law Press, Inc.™ disclaim, and have no responsibility to provide any update or otherwise notify anyone of any such change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication. Readers acknowledge and agree to the conditions of this Notice as a condition of their access to this publication. 

Circular 230 Compliance. The following disclaimer is included to ensure that we comply with U.S. Treasury Department Regulations. Any statements contained herein are not intended or written by the writer to be used, and nothing contained herein can be used by you or any other person, for the purpose of (1) avoiding penalties that may be imposed under federal tax law, or (2) promoting, marketing or recommending to another party any tax-related transaction or matter addressed herein.

©2024 Cynthia Marcotte Stamer. Limited non-exclusive right to republish granted to Solutions Law Press, Inc.™

This entry was posted on Friday, October 25th, 2024 at 5:29 PM and is filed under Corporate Compliance. You can follow any responses to this entry through the RSS 2.0 feed. Both comments and pings are currently closed.

Comments are closed.