On December 15, 2021, the New Jersey Acting Attorney General Andrew J. Bruck announced that its Division of Consumer Affairs had reached a $425,000 settlement with New Jersey-based providers of cancer care, Regional Cancer Care Associates LLC, RCCA MSO LLC and RCCA MD LLC (collectively, “RCCA”), over alleged failures to adequately safeguard patient data.

In 2019, RCCA reported two separate data breaches, in total involving the protected health information of more than 105,200 individuals, including 80,333 New Jersey residents. The first breach occurred when RCCA employee email accounts were compromised through a targeted phishing scheme that enabled unauthorized access to patient data stored on those accounts, including health records, driver’s license numbers, Social Security numbers, financial account numbers and payment card numbers. The second occurred when a third-party vendor mailed notification letters to certain living patients’ next-of-kin, which is not permissible under HIPAA.

In connection with these breaches, the Division of Consumer Affairs alleged that RCCA violated the New Jersey Consumer Fraud Act and HIPAA Privacy and Security Rules by failing to:

• ensure the confidentiality, integrity and availability of its clients’ patient data;

• protect against reasonably anticipated threats or hazards to the security or integrity of patient data;

• conduct an accurate and thorough risk assessment of potential risks and vulnerabilities to the confidentiality,...

Read Full Story: https://www.natlawreview.com/article/nj-acting-attorney-general-announces-425...