Is a ransomware event automatically a HIPAA breach?

Answer

A ransomware event requires investigation. OCR guidance explains that ransomware can involve a breach analysis; document the facts, applicable presumption and exceptions, and the notification decision.

References

• Ransomware guidance HHS Office for Civil Rights