HHS

Lehigh Valley Health Network (LVHN) has paid $800,000 to settle an investigation by the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) following a ransomware attack that exposed sensitive patient information. Announced on October 29, 2026, the settlement addresses potential violations of the HIPAA Privacy, Security, and Breach Notification Rules involving LVHN and its affiliated covered entities. The Pennsylvania health system also agreed to a corrective action plan that OCR will monitor for three years. Ransomware Attack Affected 248,359 Individuals LVHN discovered suspicious activity in its information technology system on February 4, 2023. Further investigation [...]

The settlement marks OCR’s 56th enforcement action focused on patients’ right to access their health records. October 8, 2026: The U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR), announced a $140,000 settlement with Linda L. Shen, doing business as Shen Smiles, P.C., a Pennsylvania dental practice. The agreement resolves an investigation into potential HIPAA Privacy Rule violations following a complaint that the practice failed to provide a patient with timely access to her protected health information (PHI). Patient Complaint Leads to Investigation OCR began investigating after receiving a complaint that a patient had requested her health [...]

The U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR), announced a $700,000 settlement with Ambry Genetics Corporation following an investigation into a phishing attack involving patient health information. HHS lists the settlement among its HIPAA enforcement actions announced on September 17, 2026. Ambry, a genetic testing and clinical genomics company based in Aliso Viejo, California, agreed to take corrective action to address potential violations of the HIPAA Security Rule. What Happened? In January 2020, Ambry discovered that a phishing attack had compromised an employee’s email account. The incident potentially allowed an unauthorized person to obtain [...]

The U.S. Department of Health and Human Services Office for Civil Rights, or OCR, announced a $50,000 settlement with Azul Vision, Inc. following an investigation into a potential violation of the HIPAA Privacy Rule. Azul Vision is a California healthcare provider that offers optometry and ophthalmology services. The investigation involved a complaint that the organization failed to provide a patient with timely access to her protected health information, or PHI. Patient Waited Almost Two Years for Health Records OCR received the complaint in April 2023. According to the complaint, the patient requested access to her health information in January 2023 [...]

Settlement represents OCR’s 21st ransomware enforcement action July 29, 2026: The U.S. Department of Health and Human Services Office for Civil Rights announced a settlement with OSF Healthcare System and its Affiliated Covered Entities concerning potential violations of the HIPAA Privacy, Security, and Breach Notification Rules. OSF is headquartered in Illinois and operates healthcare facilities and services in Illinois and Michigan. The settlement is the 21st enforcement action brought by OCR in connection with ransomware-related incidents. OCR Director Paula M. Stannard emphasized that conducting an accurate and thorough HIPAA risk analysis is both a legal requirement and an essential part of [...]

The U.S. Department of Health and Human Services Office for Civil Rights, also known as OCR, has announced four separate HIPAA settlements involving ransomware breaches. Together, these breaches affected more than 427,000 people and exposed unsecured electronic protected health information, also called ePHI. These settlements are an important reminder for healthcare providers, health plans, healthcare clearinghouses, and business associates. Ransomware is not just an information technology problem. It is also a HIPAA compliance problem when patient or member information is placed at risk. Ransomware is a type of malicious software that can lock or encrypt an organization’s data. The attacker then [...]

WASHINGTON — A substance use disorder treatment center in Illinois has agreed to pay a $103,000 penalty and submit to two years of federal monitoring after a successful phishing attack compromised the private health information of nearly 2,000 patients. The U.S. Department of Health and Human Services (HHS) announced a settlement this week with Top of the World Ranch Treatment Center (TWRTC) regarding potential violations of the HIPAA Security Rule. The enforcement action is part of a ongoing initiative by the HHS Office for Civil Rights (OCR) to ensure healthcare organizations are properly analyzing their security risks. The investigation was triggered by [...]

The U.S. Department of Health and Human Services (HHS) has settled with healthcare provider Concentra, Inc. for failing to provide a patient with timely access to their own medical records. An investigation found that after a patient made six requests starting in February 2018, Concentra did not provide the records until March 2019—over a year later. HIPAA law requires providers to fulfill such requests within 30 days. Concentra has agreed to pay $112,500 to resolve the case. This marks the 54th enforcement action under HHS's "Right of Access" initiative, which emphasizes that patients have a fundamental right to access their health [...]

The U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR), has reached a settlement with Deer Oaks – The Behavioral Health Solution over potential violations of the HIPAA Privacy and Security Rules. Deer Oaks, which offers psychological and psychiatric services to residents in long-term care and assisted living facilities, was found to have failed key compliance obligations under HIPAA. OCR enforces the HIPAA Privacy, Security, and Breach Notification Rules to ensure that covered entities—such as health plans, most healthcare providers, and their business associates—safeguard protected health information (PHI). The Privacy Rule establishes standards for the use and [...]

The U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR), has reached a settlement with BayCare Health System (BayCare), a Florida-based healthcare provider, regarding potential violations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Security Rule. The agreement resolves an OCR investigation into a complaint alleging unauthorized access to a patient’s electronic protected health information (ePHI). OCR enforces the HIPAA Privacy, Security, and Breach Notification Rules, which establish requirements for covered entities—including health plans, healthcare clearinghouses, and most healthcare providers—and their business associates to protect the privacy and security of protected health information (PHI). [...]