"The HIPAA Security Rule requires implementation of security measures that can help prevent the introduction of malware, including ransomware.... The HIPAA Security Rule requires covered entities and business associates to implement policies and procedures that can assist an entity in responding to and recovering from a ransomware attack.... What should covered entities or business associates do if their computer systems are infected with ransomware? ... Is it a HIPAA breach if ransomware infects a covered entity's or business associate's computer system? ... Is it a reportable breach if the ePHI encrypted by the ransomware was already encrypted to comply with HIPAA?" [Undated and unnumbered document, published online on July 11, 2016.]  MORE >>