HIPAA, not 42 CFR, used in personal health information violations

Top of the World Ranch Treatment Center, a 24‐bed facility in Milan, Illinois, experienced a successful phishing attack in 2023; in which a third part accessed personal health information through an employee's email account. The treatment center reported the breach to the federal Department of Health and Human Services, noting the Office for Civil Rights (OCR) that as a result, personal health information of 1,980 patients was compromised. OCR investigated and found that the treatment center failed to conduct a thorough risk analysis to determine the potential risks and vulnerabilities to the confidentiality, integrity, and availability of personal health information held by the center. The HIPAA Security Rule of 1996 requires this.