A new phishing scam targeting HIPAA-covered entities and
their business associates is masquerading as an official communication from the
U.S. Department of Health and Human Services (HHS) Office for Civil Rights
(OCR).
In an alert released Nov. 28, OCR advised that the phishing email, from the email address OSOCRAudit@hhs-gov.us, is being circulated on mock HHS letterhead with the signature of OCR Director Jocelyn Samuels. The email directs you to click a link regarding possible inclusion in the HIPAA audit program. In fact, the link leads to a nongovernmental website selling a private firm’s cyber security services, OCR said.
If you receive the phishing email or are not certain if an email from OCR is an official email, contact OCR at OSOCRAudit[at]hhs[dot]gov.
(Note the subtle difference in the fake URL above and this legitimate URL.)
The HIPAA audit program has stalled since the first round of covered entity desk audits were performed in July, according to Medicare Compliance Watch. Desk audits of business associates and on-site audits apparently have been postponed.
Published Dec. 16, 2016
TMA Practice E-Tips main page
Last Updated On
December 19, 2016
Originally Published On
December 16, 2016