Regional Women's Health Group, LLC

HHS OCR settled with Regional Women’s Health Group, LLC (doing business as Axia Women’s Health) for $320,000 regarding a cyberattack impacting over 37,000 patients. The settlement addresses noncompliance with the HIPAA Security Rule, specifically the failure to conduct an accurate and thorough risk analysis of ePHI vulnerabilities. The agreement includes a Corrective Action Plan requiring risk analysis, risk management, and policy updates.

Regional Women's Health Group, LLC (NJ) reported to HHS on 2022-10-10 an Unauthorized Access/Disclosure affecting 804 individuals. An employee impermissibly downloaded PHI — including names, addresses, dates of birth, driver's license and Social Security numbers, and claims information — to a personal device. The CE sanctioned the employee, notified HHS, affected individuals, and media, and provided credit monitoring and a call center.

HHS OCR Breach Portal entry: Regional Women's Health Group, LLC d/b/a Sincera Reproductive Medicine (PA, Healthcare Provider) reported a Hacking/IT Incident affecting a network server, impacting 37,989 individuals. Submitted 2020-12-03. No business associate involvement indicated. No narrative description provided in the portal row.

Women's Health Care Group of PA, LLC, a Pennsylvania healthcare provider, reported to HHS OCR on 2017-07-15 that a ransomware attack affected ePHI of 300,000 individuals stored on a desktop computer and network server. Compromised data included names, addresses, dates of birth, Social Security numbers, and clinical information. The CE notified HHS, affected individuals, and the media, and implemented additional administrative and technical safeguards. OCR provided technical assistance and obtained assurances of corrective actions.