Blog

The settlement marks OCR’s 56th enforcement action focused on patients’ right to access their health records. October 8, 2026: The U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR), announced a $140,000 settlement with Linda L. Shen, doing business as Shen Smiles, P.C., a Pennsylvania dental practice. The agreement resolves an investigation into potential HIPAA Privacy Rule violations following a complaint that the practice failed to provide a patient with timely access to her protected health information (PHI). Patient Complaint Leads to Investigation OCR began investigating after receiving a complaint that a patient had requested her health [...]

The U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR), announced a $700,000 settlement with Ambry Genetics Corporation following an investigation into a phishing attack involving patient health information. HHS lists the settlement among its HIPAA enforcement actions announced on September 17, 2026. Ambry, a genetic testing and clinical genomics company based in Aliso Viejo, California, agreed to take corrective action to address potential violations of the HIPAA Security Rule. What Happened? In January 2020, Ambry discovered that a phishing attack had compromised an employee’s email account. The incident potentially allowed an unauthorized person to obtain [...]

The U.S. Department of Health and Human Services Office for Civil Rights, or OCR, announced a $50,000 settlement with Azul Vision, Inc. following an investigation into a potential violation of the HIPAA Privacy Rule. Azul Vision is a California healthcare provider that offers optometry and ophthalmology services. The investigation involved a complaint that the organization failed to provide a patient with timely access to her protected health information, or PHI. Patient Waited Almost Two Years for Health Records OCR received the complaint in April 2023. According to the complaint, the patient requested access to her health information in January 2023 [...]

Settlement represents OCR’s 21st ransomware enforcement action July 29, 2026: The U.S. Department of Health and Human Services Office for Civil Rights announced a settlement with OSF Healthcare System and its Affiliated Covered Entities concerning potential violations of the HIPAA Privacy, Security, and Breach Notification Rules. OSF is headquartered in Illinois and operates healthcare facilities and services in Illinois and Michigan. The settlement is the 21st enforcement action brought by OCR in connection with ransomware-related incidents. OCR Director Paula M. Stannard emphasized that conducting an accurate and thorough HIPAA risk analysis is both a legal requirement and an essential part of [...]

The U.S. Department of Health and Human Services Office for Civil Rights, also known as OCR, has announced four separate HIPAA settlements involving ransomware breaches. Together, these breaches affected more than 427,000 people and exposed unsecured electronic protected health information, also called ePHI. These settlements are an important reminder for healthcare providers, health plans, healthcare clearinghouses, and business associates. Ransomware is not just an information technology problem. It is also a HIPAA compliance problem when patient or member information is placed at risk. Ransomware is a type of malicious software that can lock or encrypt an organization’s data. The attacker then [...]