Health care organizations store tens of millions of patients' personal health information, which is highly regulated by the federal Health Insurance Portability and Accountability Act of 1996. But cyber extortion attempts are not uncommon, according to HHS's Office for Civil Rights, which enforces HIPAA on behalf of the federal agency. Breaches of unsecured protected health information must be reported to the agency under federal law.

“Incidents of cyber extortion have risen steadily over the past couple of years and, by many estimates, will continue to be a major source of disruption for many organizations,” according to the OCR's January newsletter. “Organizations that provide necessary services or maintain sensitive data, such as Healthcare and Public Health (HPH) sector organizations are often the targets of cyber extortion attacks.”

To help health care organizations avoid attacks, the OCR provides the following tips:

• Train employees to identify unusual emails and other messages that hackers could use to break into your system.

• Document suspicious activity and review those logs regularly.

• Perform a risk analysis that looks at the entire organization and fix known risks.

• Use anti-malware programs to prevent access by malicious software proactively.

• Implement and test cyberattack recovery plans.

• Encrypt and back up sensitive data.

• Stay on top of new and emerging cyberthreats, perhaps by signing up for governmental alerts known as US-CERT alerts, which are generated by the government's National Cyber Awareness System and received via email or an RSS feed and provide timely information about security issues.