Physician Practices Beware: Scam Email Disguised as Communication from Office of Civil Rights

By Joy Hord, Parker Poe
Reprinted with permission from Parker Poe

Receiving an email that your practice has been identified for participating in the HIPAA Privacy, Security, and Breach Rules Audit Program is enough to raise anyone’s blood pressure. The likely response is to open the email immediately, determine the scope of the audit, and mobilize a team to prepare for the response.

Opening the email, however, may not direct the email recipient to information regarding a governmental HIPAA audit. Instead, some providers are finding that the link directs to a non-governmental company’s marketing efforts for a cybersecurity service. The Office of Civil Rights (OCR) of the Department of Health and Human Services (the entity responsible for HIPAA audits and enforcement) has published alerts (available here) regarding the scam emails.

Although nothing in the most-recent alerts suggests that the current scam emails will result in a malware attack, covered entities and business associates must remain on guard regarding the potential risks of opening a communication that may appear to come from the OCR. Providers who have a question regarding whether an email is an official communication from OCR regarding a HIPAA audit may contact the OCR at OSOCRAudit@hhs.gov. Official communications from the OCR original from the same address.

Parker Poe has developed a number of tools to assist our clients to perform self-audits regarding compliance with the privacy, security and breach notification rules under HIPAA. We also advise clients routinely regarding responses to HIPAA audits. More information regarding our team can be found here.

About the Author
Joy Hord focuses her practice on regulatory and compliance matters specifically related to the health care industry. Her clients include hospitals, physicians, pharmacies and other health care providers. Ms. Hord also has significant experience representing health care professionals and organizations with business law and transactional issues, such as mergers, acquisitions and joint ventures. Ms. Hord leads Parker Poe’s Health Care Practice, which includes attorneys from the firm’s North Carolina and South Carolina offices.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: