The settlement comes as regulators have been sounding the alarm about cybersecurity in the healthcare sector. More than 134 million people were affected by large breaches reported to the OCR last year, compared with just 55 million in 2022, according to the agency.
The HHS released a concept paper late last year that outlined its strategy to support cybersecurity in the industry. The paper included proposals to enforce cyber standards at hospitals through Medicare and Medicaid.
But the agency has also promoted voluntary goals, which it said could help healthcare organizations prevent attacks, improve their response and minimize remaining risk. It’s also settled cases with other providers, including claims related to ransomware and phishing attacks.
