NuLLFiX

The U.S. Department of Health and Human Services Office for Civil Rights, or OCR, announced a $50,000 settlement with Azul Vision, Inc. following an investigation into a potential violation of the HIPAA Privacy Rule. Azul Vision is a California healthcare provider that offers optometry and ophthalmology services. The investigation involved a complaint that the organization failed to provide a patient with timely access to her protected health information, or PHI. Patient Waited Almost Two Years for Health Records OCR received the complaint in April 2023. According to the complaint, the patient requested access to her health information in January 2023 [...]

Settlement represents OCR’s 21st ransomware enforcement action July 29, 2026: The U.S. Department of Health and Human Services Office for Civil Rights announced a settlement with OSF Healthcare System and its Affiliated Covered Entities concerning potential violations of the HIPAA Privacy, Security, and Breach Notification Rules. OSF is headquartered in Illinois and operates healthcare facilities and services in Illinois and Michigan. The settlement is the 21st enforcement action brought by OCR in connection with ransomware-related incidents. OCR Director Paula M. Stannard emphasized that conducting an accurate and thorough HIPAA risk analysis is both a legal requirement and an essential part of [...]

The U.S. Department of Health and Human Services Office for Civil Rights, also known as OCR, has announced four separate HIPAA settlements involving ransomware breaches. Together, these breaches affected more than 427,000 people and exposed unsecured electronic protected health information, also called ePHI. These settlements are an important reminder for healthcare providers, health plans, healthcare clearinghouses, and business associates. Ransomware is not just an information technology problem. It is also a HIPAA compliance problem when patient or member information is placed at risk. Ransomware is a type of malicious software that can lock or encrypt an organization’s data. The attacker then [...]

WASHINGTON — A substance use disorder treatment center in Illinois has agreed to pay a $103,000 penalty and submit to two years of federal monitoring after a successful phishing attack compromised the private health information of nearly 2,000 patients. The U.S. Department of Health and Human Services (HHS) announced a settlement this week with Top of the World Ranch Treatment Center (TWRTC) regarding potential violations of the HIPAA Security Rule. The enforcement action is part of a ongoing initiative by the HHS Office for Civil Rights (OCR) to ensure healthcare organizations are properly analyzing their security risks. The investigation was triggered by [...]

The U.S. Department of Health and Human Services (HHS) has settled with healthcare provider Concentra, Inc. for failing to provide a patient with timely access to their own medical records. An investigation found that after a patient made six requests starting in February 2018, Concentra did not provide the records until March 2019—over a year later. HIPAA law requires providers to fulfill such requests within 30 days. Concentra has agreed to pay $112,500 to resolve the case. This marks the 54th enforcement action under HHS's "Right of Access" initiative, which emphasizes that patients have a fundamental right to access their health [...]