Enforcement and Real Cases: OCR Penalties, Settlements and Hospital Ransomware

Rule versions described in this lesson: the HIPAA Enforcement Rule, 45 CFR Part 160, Subparts C, D and E, as amended by the 2013 Omnibus Rule (78 FR 5566, January 25, 2013), current eCFR text read October 28, 2026; civil money penalty amounts as adjusted at 45 CFR 102.3 by 91 FR 3665 (January 28, 2026), with no 2026 adjustment per HHS's notice of October 21, 2026 (91 FR 66566); the Notification of Enforcement Discretion at 84 FR 18151 (April 30, 2019); 42 U.S.C. 1320d-5, 1320d-6 and 17941 as of October 28, 2026. Enforcement counts are as OCR stated them in releases through October 8, 2026. Rules, amounts and counts change; check the regulator's current text before relying on any figure.

HIPAA has had enforceable privacy rules since 2003 and security rules since 2005, and for most of that time the public face of enforcement has been a short HHS press release: an organization, a dollar figure, a few lines about what went wrong. Those releases are worth reading closely. Each one is the visible end of a long process, and each resolution agreement behind it is a public document that says, in plain terms, what the government thinks the organization failed to do. Read together, they are the most honest map available of how health care organizations get hurt.

This lesson covers that process from the first complaint to the federal courts, the penalty math, the other enforcers (the Justice Department and state attorneys general), the court case that forced HHS to change how it fines, the record settlements, OCR's ransomware and risk analysis enforcement through October 2026, and the hospital ransomware attacks that set the stakes. It ends with what reporters and advocates can request and check. If you need the basic overview of who HIPAA covers and what the penalties look like at a glance, read Health Privacy: HIPAA and Beyond first. The risk analysis OCR keeps asking for is taught step by step in lesson 4, and the breach notice clock is in lesson 5.

How OCR enforcement works

The Secretary of Health and Human Services has delegated HIPAA civil enforcement to OCR, which also enforces federal civil rights laws in health care and, with complaints accepted since February 16, 2026, the 42 CFR Part 2 rules for substance use disorder records.¹ OCR's Director in 2026 is Paula M. Stannard, who is quoted in the year's enforcement releases.² The procedures OCR follows are written down in the HIPAA Enforcement Rule, 45 CFR Part 160, Subparts C (compliance and investigations), D (civil money penalties) and E (hearing procedures).³

Where cases come from

OCR cases begin in four ways.

1. Complaints. Anyone who believes a covered entity or business associate is violating the rules may file a written complaint, on paper or electronically. It must name the organization, describe what happened, and be filed within 180 days of when the complainant knew or should have known of the problem, though OCR can waive that deadline for good cause. OCR must investigate when a preliminary review of the facts indicates a possible violation due to willful neglect, and it may investigate any other complaint (45 CFR 160.306, as amended January 25, 2013).⁴
2. Breach reports. Every breach of unsecured protected health information affecting 500 or more people must be reported to HHS at the same time patients are notified, and smaller breaches go in an annual log. OCR's breach portal says the office investigates all breaches of protected health information and Part 2 records that affect 500 or more individuals, and may investigate smaller ones depending on resources and priorities.⁵ In 2024, 665 of the 730 compliance reviews OCR opened came from breach reports.⁶
3. Compliance reviews. OCR can open a review on its own, for example after a news report, a dark web posting or a referral. It must conduct one when preliminary facts suggest a possible violation due to willful neglect (45 CFR 160.308).⁷ The 2026 MMG Fusion settlement began this way: OCR learned of a December 2020 intrusion affecting about 15 million people through a complaint and a dark web posting, not through a timely breach report.⁸
4. Audits. HITECH requires HHS to conduct periodic audits. OCR ran a first round of audits around 2012 and a second phase in 2016 and 2017 that covered 166 covered entities and 41 business associates. OCR's own report to Congress for calendar year 2024 says it "did not initiate any audits in 2024 due to a lack of financial resources." Trade press reported that OCR said in December 2024 it was restarting audits with a round of about 50 covered entities and business associates, focused on the Security Rule provisions most relevant to hacking and ransomware.⁶⁹ An audit is not supposed to be an enforcement action, but a serious problem found in an audit can lead to a compliance review.

What an investigation looks like

An investigation starts with a letter. OCR's first written communication must describe the acts or omissions at issue (45 CFR 160.306(c)).⁴ What follows is usually a data request: copies of the most recent risk analysis and the ones before it, the risk management plan, Security Rule policies and procedures, evidence of workforce training, audit log samples, business associate agreements, the breach risk assessment and the notice letters with their mailing dates. OCR may also interview staff and ask for a timeline of the incident. Investigations of large breaches often take years. OSF HealthCare discovered its ransomware infection in April 2021 and filed its breach report in October 2021; the settlement was announced July 29, 2026.¹⁰ Ambry Genetics' phishing attack happened in January 2020; its settlement was announced September 17, 2026.¹¹

That lag matters when you read the news. A 2026 settlement usually describes 2020 or 2021 security practices, and the organization may have rebuilt its program since. It also means a breach announced this year will probably not produce an OCR result for several years, if ever.

Four ways a case can end

Under 45 CFR 160.312 (as amended January 25, 2013), a case can end in one of four broad ways.¹²

The counts in that table come from OCR's Enforcement Highlights page, which had not been updated past October 31, 2024 when this lesson was checked.¹³ The same page reported more than 374,321 complaints received since April 2003, more than 1,193 compliance reviews, and 2,419 cases referred to the Justice Department for possible criminal investigation. The most common allegations, in order, were impermissible uses and disclosures, lack of safeguards, lack of patient access to records, lack of administrative safeguards for electronic records, and using or disclosing more than the minimum necessary.

For a single recent year, OCR's report to Congress for 2024 gives the shape of the work: 30,256 new complaints, 28,228 resolved, 730 compliance reviews opened, and 22 resolutions by resolution agreement or civil money penalty totaling $9,944,612.⁶ In other words, less than one tenth of one percent of complaints end with money changing hands.

Resolution agreements and corrective action plans

A resolution agreement is a settlement contract between HHS and the organization. The OSF HealthCare agreement signed July 1, 2026 is a good current example of the standard structure.¹⁴

• Covered conduct. A short list of what OCR found. For OSF: no accurate and thorough risk analysis, impermissible disclosure of the protected health information of 53,907 people in the ransomware attack, late notice to individuals, and late notice to the Secretary.
• No admission. The agreement says it "is not an admission of liability" by the organization. HHS, in turn, does not concede that no violation occurred. This is why news stories should say OCR "found potential violations," not that the organization "was found guilty."
• Payment. A resolution amount, here $552,250 in one lump sum.
• Corrective action plan (CAP). The CAP is the part that costs the most staff time. OSF's runs two years. It must submit the scope and method of a new risk analysis to HHS within 60 days, deliver the analysis within 90 days after HHS approves the method, revise it within 30 days of HHS comments, repeat it annually, and submit a risk management plan within 90 days of HHS approving the analysis. It must report workforce violations of its policies to HHS as "Reportable Events," and file annual reports with an officer's attestation.
• Teeth. If the organization breaches the CAP and does not cure the breach within 30 days of a notice, HHS may impose civil money penalties for the original conduct. The statute of limitations is paused while the agreement runs.

CAPs used to run two years almost by default. The first ransomware settlement, with Doctors' Management Services in October 2023, ran three years, as did the first Risk Analysis Initiative action, Bryan County Ambulance Authority, in October 2024.¹⁵¹⁶ Most 2026 releases describe two years of monitoring.

Civil money penalties and the appeal path

When an organization will not settle, or OCR decides a penalty is warranted, the Enforcement Rule lays out a formal path.¹²¹⁷¹⁸

1. Notice and chance to respond. OCR tells the organization the matter was not resolved informally and gives it 30 days to submit written evidence of mitigating factors (45 CFR 160.408) or affirmative defenses (45 CFR 160.410).
2. Notice of proposed determination. If OCR still finds a penalty warranted, it issues a notice of proposed determination under 45 CFR 160.420 stating the findings, the penalty amount and the basis for it.
3. Hearing request. The organization has 90 days from receipt of the notice to request a hearing before an HHS administrative law judge (ALJ). The request must respond to each finding of fact and state the defenses (45 CFR 160.504). If no one requests a hearing, the penalty becomes final.
4. ALJ hearing and decision. The ALJ hears evidence and issues a decision on liability and amount.
5. Departmental Appeals Board. Either side may appeal to the Board, which 45 CFR 160.502 defines as "the members of the HHS Departmental Appeals Board, in the Office of the Secretary, who issue decisions in panels of three." The notice of appeal is due within 30 days of service of the ALJ decision. The Board's decision becomes the Secretary's final decision 60 days after service unless it remands or reconsideration is sought (45 CFR 160.548).
6. Federal court. The organization may petition a federal court of appeals within 60 days after the decision becomes final (45 CFR 160.548(k)).

Very few cases reach the end of that line. The best known one, the University of Texas MD Anderson Cancer Center case, is covered below, and it changed how HHS fines everyone.

The penalty math

Civil money penalties are where most confusion starts, because there are three layers: the statute, HHS's regulation, and HHS's own 2019 promise to use lower caps than its regulation allows. On top of that, every amount is adjusted for inflation each year, except in 2026.

The four tiers

HITECH section 13410 (codified at 42 U.S.C. 1320d-5) created four tiers of culpability, and HHS wrote them into 45 CFR 160.404(b)(2) through the 2009 interim rule and the 2013 Omnibus Rule.¹⁹²⁰²¹

1. Did not know. The organization did not know, and by exercising reasonable diligence would not have known, of the violation.
2. Reasonable cause. The violation was due to reasonable cause and not to willful neglect. Under the 2013 definitions in 45 CFR 160.401, reasonable cause means the organization knew, or by exercising reasonable diligence would have known, that the act or omission violated a rule, but did not act with willful neglect.
3. Willful neglect, corrected. "Conscious, intentional failure or reckless indifference" to the obligation (160.401), but corrected within 30 days of when the organization knew or should have known.
4. Willful neglect, not corrected. The same, but not corrected within 30 days.

Current amounts, as of October 28, 2026

The Federal Civil Penalties Inflation Adjustment Act Improvements Act of 2015 requires agencies to raise civil penalty amounts every January using the October consumer price index. HHS published its most recent adjustment on January 28, 2026, at 91 FR 3665, setting the "2025" amounts listed in 45 CFR 102.3.²² Then, on October 21, 2026, HHS published a notice (91 FR 66566) cancelling the 2026 adjustment because the Bureau of Labor Statistics did not produce October 2025 consumer price index data during the lapse in federal appropriations; HHS said it "will continue to use the 2025 civil monetary penalty levels."²³ The notice itself cites OMB Memorandum M-26-11, issued April 17, 2026, which cancelled the 2026 adjustment.²³ HIPAA Journal, reporting the notice on October 22, 2026, tied it to an April 2026 Office of Management and Budget memo cancelling the 2026 adjustments government-wide.²⁴

So the amounts in effect today are these:

Sources for the table: the first four columns are the 2025 amounts in 91 FR 3665 (January 28, 2026), still in effect because the 2026 adjustment was cancelled. For violations before February 18, 2009, the amount is $198 per violation with a $49,848 calendar-year cap. For comparison, the 2024 minimums were $141, $1,424, $14,232 and $71,162, with a $2,134,831 cap.²² The last column applies the 2019 Notice of Enforcement Discretion caps with the 2025 inflation multiplier, as computed and published by HIPAA Journal; HHS's Federal Register table does not print those adjusted caps, so treat them as secondary-sourced.²⁵

Why the caps are lower in practice: the 2019 notice

The statute itself, 42 U.S.C. 1320d-5(a)(3), sets different annual caps for each tier: before inflation, $25,000 for tier one, $100,000 for tier two, $250,000 for tier three and $1,500,000 for tier four, with per-violation amounts of $100, $1,000, $10,000 and $50,000 at the bottom of each tier.²⁰ HHS's 2009 interim rule, carried into 160.404, read the statute differently and applied a $50,000 per-violation maximum and a $1,500,000 annual cap to every tier.

On April 30, 2019, HHS published a Notification of Enforcement Discretion (84 FR 18151, dated April 23, 2019) stating that it would apply the lower, tier-by-tier annual caps: $25,000, $100,000, $250,000 and $1,500,000 before inflation, "effective indefinitely," until it changes the regulation.²⁶ HHS has not amended 160.404 to match, so the regulation's table and the caps OCR actually applies still differ. Reporters who quote the "$2.19 million per year" figure for a reasonable-cause violation are quoting the regulation, not current practice.

How violations are counted

The cap applies per identical provision per calendar year, and the number of violations depends on the obligation. Under 45 CFR 160.406, OCR counts violations by the nature of the duty (to act, to act within a time, or to act or not act toward particular people), and "a separate violation occurs each day" an organization is in continuing violation.²⁷ A missing risk analysis can therefore be counted per day for years, while an impermissible disclosure can be counted per person. Several different provisions can each carry their own cap, which is how a single case can exceed one tier's annual limit.

What raises or lowers a penalty

45 CFR 160.408 lists the factors OCR must consider, each of which can mitigate or aggravate.²⁸

• Nature and extent of the violation, including the number of people affected and how long it lasted.
• Nature and extent of the harm, including physical, financial or reputational harm, and whether the violation hindered someone's ability to get health care.
• History of prior compliance, including earlier similar problems, efforts to fix them, and how the organization responded to technical assistance and prior complaints.
• Financial condition, including whether financial difficulty affected compliance, whether a penalty would jeopardize the ability to keep providing or paying for care, and the organization's size.
• "Such other matters as justice may require."

The financial condition factor is visible in the 2026 releases. OCR said it considered MMG Fusion's financial condition in settling for $10,000 after an intrusion affecting about 15 million people.⁸ For small clinics, this is the factor that keeps a case from becoming ruinous; it is not a reason to skip the work.

45 CFR 160.410 adds affirmative defenses: OCR may not impose a penalty for a violation that is not due to willful neglect if the organization corrected it within 30 days of when it knew or should have known (or a longer period OCR allows), and it may not impose one where a criminal penalty has already been imposed for the same act under 42 U.S.C. 1320d-6.²⁹ The statute also lets the Secretary waive all or part of a penalty for a reasonable-cause failure if payment "would be excessive relative to the compliance failure involved" (42 U.S.C. 1320d-5(b)(3)).²⁰

Credit for recognized security practices

Public Law 116-321, enacted January 5, 2021, added section 13412 to HITECH (42 U.S.C. 17941). It says the Secretary "shall consider" whether a covered entity or business associate adequately demonstrated that it had recognized security practices in place for not less than the previous 12 months when deciding fines, the outcome of audits, and other remedies.³⁰ Recognized security practices include the standards developed under the NIST Act (the NIST Cybersecurity Framework is the common example) and the approaches published under section 405(d) of the Cybersecurity Act of 2015 (the Health Industry Cybersecurity Practices, or HICP).³⁰³¹

Three points get lost in vendor marketing about this law.

• It is a mitigation factor, not a safe harbor. It does not stop OCR from finding a violation, and it does not let an organization skip the Security Rule.
• The organization has to demonstrate the practices, which means records: policies tied to a framework, evidence of implementation, assessments and dates covering the prior 12 months.
• The law also says it may not be construed to let the Secretary increase a penalty because an organization did not adopt recognized security practices. Not having them is not itself a violation.

OCR has not published a list of cases where recognized security practices reduced a payment, so the size of the credit cannot be measured from public records. That is a fair question for reporters to put to OCR.

The MD Anderson case: when OCR lost in court

The University of Texas MD Anderson Cancer Center case is the best-known HIPAA civil money penalty thrown out by a federal appeals court, and it still shapes how OCR writes its cases.

What happened

In 2012 and 2013, an MD Anderson faculty member's unencrypted laptop was stolen, and a trainee and a visiting researcher each lost an unencrypted USB thumb drive. Together the devices held protected health information of nearly 35,000 people. OCR imposed a civil money penalty of $4,348,000: $1,348,000 for violating the encryption standard and $3,000,000 ($1,500,000 for 2012 and $1,500,000 for 2013) for impermissible disclosures. An HHS administrative law judge upheld the penalty in June 2018, and the Departmental Appeals Board affirmed.³²³³

What the Fifth Circuit decided

On January 14, 2021, a unanimous Fifth Circuit panel (Judges Wiener, Engelhardt and Oldham, opinion by Judge Andrew S. Oldham) vacated the penalty in University of Texas M.D. Anderson Cancer Center v. U.S. Department of Health and Human Services, No. 19-60226.³² The court's reasoning had four parts.

• Encryption. The technical safeguard at issue required "a mechanism" to encrypt electronic protected health information. The court held that MD Anderson had such a mechanism; the fact that some employees did not use it showed imperfect enforcement, not the absence of a mechanism. The court said HHS could write a stricter rule if it wanted one.
• Disclosure. The court read "disclosure" to require an affirmative act that releases information to someone outside the organization. A theft or loss, standing alone, was not shown to be a disclosure, and the government conceded it could not meet that reading.
• Treat like cases alike. OCR had imposed no penalty in comparable lost-device cases, including one involving Cedars-Sinai. The court held that an agency must treat similarly situated parties alike or explain why not, and that HHS had not.
• Caps. Before the court, HHS conceded it could not defend a penalty above $450,000. The court also held that the statutory annual cap for reasonable-cause violations was $100,000, consistent with the 2019 Notice of Enforcement Discretion.

The court granted the petition, vacated the penalty order and remanded the case.

What it means for OCR and for everyone else

• OCR now leans on clear duties. Look at the "covered conduct" in post-2021 resolution agreements: failure to conduct an accurate and thorough risk analysis, failure to implement audit controls, failure to notify on time. These are discrete obligations that are hard to argue about. A missing risk analysis is a fact, not a judgment call about how well a mechanism was enforced.
• Theft is pleaded differently. Instead of relying only on "impermissible disclosure" after a theft, OCR's ransomware cases pair the breach with the security failures that made it possible.
• Consistency matters. Organizations facing a penalty can and do compare their facts to earlier cases. That is one reason OCR publishes resolution agreements in full.
• The decision binds only the Fifth Circuit (Texas, Louisiana and Mississippi), though other courts may find it persuasive. It does not change the Security Rule text, and the "addressable" encryption standard it interpreted is the same one HHS proposed in January 2025 to make required, with limited exceptions. That proposal is still not final; HHS's 2026 regulatory agenda lists final action as July 2027, as a long-term action.³⁴³⁵
• It does not mean losing a laptop is fine. An unencrypted lost device is still presumed to be a reportable breach under the Breach Notification Rule unless a risk assessment shows a low probability of compromise (see lesson 5).

Criminal penalties and the Justice Department

HIPAA is also a criminal statute. Under 42 U.S.C. 1320d-6, a person who knowingly, and in violation of the HIPAA rules, obtains individually identifiable health information or discloses it to another person can be fined and imprisoned.³⁶ HITECH added a sentence making clear that a person, "including an employee or other individual," is covered if the information is maintained by a covered entity and the person obtained or disclosed it without authorization. So a hospital clerk who looks up a neighbor's chart and passes it on can be prosecuted personally, not only the hospital.

OCR does not prosecute. It refers cases to the Justice Department, which had received 2,419 such referrals as of October 31, 2024 by OCR's count.¹³ U.S. Attorneys bring the cases, often alongside identity theft, fraud or computer crime charges, and usually against individuals rather than organizations. Two examples from Justice Department releases:

• In June 2019, a former patient information coordinator in western Pennsylvania was sentenced to a year in prison after accessing the records of 111 patients she had no reason to see and disclosing two people's health information with intent to embarrass them. According to the Justice Department release, the court "offered that" her conduct "was the most egregious of its kind."³⁷
• In June 2022, a Des Moines man was sentenced to 27 months in prison for conspiring with a then-employee of the Veterans Affairs Medical Center to obtain a patient's mental health and medication records held by the medical center without authorization and pass them to a third party.³⁸

Ransomware gangs, the people behind most of the large breaches in this lesson, are prosecuted under computer fraud and extortion laws, not HIPAA. HIPAA's criminal provision is mostly about insiders who snoop, sell or leak.

State attorneys general

HITECH section 13410(e), codified at 42 U.S.C. 1320d-5(d), lets a state attorney general sue in federal district court as parens patriae (on behalf of the state's residents) to stop HIPAA violations or recover damages.²⁰ The statutory damages are modest: up to $100 per violation, capped at $25,000 for all violations of an identical requirement in a calendar year, plus costs and attorney fees at the court's discretion. The state must give HHS prior written notice and a copy of the complaint, HHS may intervene, and a state may not sue over a violation while a federal action on it is pending.

Because the HIPAA damages are capped so low, states usually combine HIPAA claims with their own consumer protection, unfair trade practice and data breach laws, which can carry much larger penalties. Three examples show the range.

• Inmediata (2023). On October 17, 2023, a group of 33 attorneys general announced a $1.4 million settlement with Inmediata, a health care clearinghouse, over a coding problem that left protected health information of about 1.5 million people searchable online for almost three years. The states alleged violations of HIPAA, state consumer protection laws and state breach notice laws, including notices that went out more than three months late and were misaddressed or unclear. OCR had alerted Inmediata to the exposure on January 15, 2019.³⁹
• Anthem (2020). On September 30, 2020, a multistate coalition of attorneys general, joined by California, announced a $39.5 million settlement with Anthem over the cyberattack that began in February 2014 and was disclosed in February 2015, affecting 78.8 million Americans. That was more than twice Anthem's $16 million OCR payment for the same breach, in a separate state action.⁴⁰
• Nebraska v. Change Healthcare (2024 to 2026). On December 16, 2024, Nebraska Attorney General Mike Hilgers sued Change Healthcare, UnitedHealth Group and Optum in Lancaster County District Court over the February 2024 attack, which he said affected at least 575,000 Nebraskans. The complaint relies on state consumer protection, deceptive trade practices and data security laws and alleges a lack of multifactor authentication and slow notification.⁴¹ In November 2025 the court denied the companies' motion to dismiss and let the case proceed; Optum said it would "continue to defend ourselves vigorously."⁴²

Idaho's attorney general has the same HIPAA authority as every other state's, and Idaho Code 28-51-107 lets the primary regulator sue over breach notice failures, with a fine of up to $25,000 per breach for intentional failure to notify. This lesson found no Idaho attorney general HIPAA suit in the public record as of October 28, 2026. The Idaho attorney general does post the breach notices it receives, which is covered in the reporters section below.

Major OCR settlements and penalties

The table lists the largest and most instructive OCR resolutions found on OCR's resolution agreement list and in its press releases. "Settlement" means a resolution agreement with a corrective action plan; "CMP" means a civil money penalty OCR imposed.

The descriptions in the "what OCR described" column for the 2024 and 2025 civil money penalties are deliberately short; OCR's notices of final determination give the full findings, and the amounts and dates come from OCR's list. No 2025 or 2026 OCR action comes anywhere near Anthem. The largest 2026 payment found when this lesson was checked was Ambry Genetics at $700,000.⁴⁵

What the money does and does not show

A settlement amount is a negotiated number, not a measure of harm. MMG Fusion paid $10,000 over an intrusion affecting about 15 million people, while Anthem paid $16 million for one affecting almost 79 million. The difference reflects financial condition, the strength of the evidence, the year and each side's willingness to litigate. Since the 2019 enforcement discretion notice, the annual caps for the lower tiers also put a ceiling on what OCR can credibly demand in a case without willful neglect.

The bigger cost for most organizations is the corrective action plan and the incident itself. An organization under a CAP must submit its risk analysis and risk management plan to OCR for approval, report workforce violations, and keep records for six years.¹⁴ And the recovery costs of a ransomware attack (reported at almost $113 million in lost revenue and recovery for Scripps Health in 2021 and about $160 million for CommonSpirit in 2022) dwarf any OCR settlement.⁴⁷⁴⁸ For continuity planning and how cyber insurance fits, see Continuity, Recovery and Cyber Insurance.

OCR's ransomware enforcement

OCR announced its first ransomware settlement, with Doctors' Management Services, on October 31, 2023. Unauthorized access to that business associate's network began April 1, 2017 and was not detected until December 24, 2018, when ransomware was deployed; OCR said more than 206,000 people were affected, and the three-year CAP was longer than most before it.¹⁵ Since then OCR has numbered its ransomware actions in its press releases.

Other ransomware actions between those markers, from OCR's list and releases, include Providence Medical Institute (civil money penalty of $240,000, October 3, 2024), Bryan County Ambulance Authority ($90,000, October 31, 2024), Northeast Surgical Group ($10,000, January 15, 2025), Guam Memorial Hospital Authority ($25,000, April 17, 2025), a neurology practice ($25,000, April 25, 2025), Comstar, LLC (May 30, 2025), Syracuse ASC (July 23, 2025) and BST and Co. CPAs, a business associate accounting firm ($175,000, August 18, 2025, which OCR called its 15th ransomware and 10th Risk Analysis Initiative action).⁴⁵⁵¹⁵² The April 23, 2026 package included Assured Imaging ($375,000, 244,813 people), Regional Women's Health Group, doing business as Axia Women's Health ($320,000, 37,989 people), Consociate Health, a business associate ($225,000, about 136,539 people), and the Star Group L.P. Health Benefits Plan ($245,000, about 9,316 people), for a total of $1,165,000. OCR said in that release that hacking and ransomware are the most frequent type of large breach reported to it.⁵⁰

What the ransomware cases say

OCR's position, stated in ransomware guidance it issued July 11, 2016, is that when ransomware encrypts electronic protected health information, "unauthorized individuals have taken possession or control of the information," so the attack is presumed to be a breach unless the organization can show a low probability that the information was compromised.⁵³ The cases add a second message: the attack is usually not the violation. The violations are the things that were missing before the attack. In the OSF agreement, the covered conduct begins with the failure to conduct an accurate and thorough risk analysis and ends with late notices.¹⁴ The OSF release closed with a list of steps OCR wants every regulated entity to take, quoted here because it is the clearest statement of what OCR looks for:¹⁰

• "Identify where ePHI is located in the organization, including how ePHI enters, flows through, and leaves" its information systems.
• "Periodically conduct, and update as needed, a risk analysis and develop and implement a risk management plan."
• "Ensure audit controls are in place to record and examine information system activity."
• "Implement regular review of information system activity."
• "Utilize mechanisms to authenticate information to ensure only authorized users are accessing ePHI."
• "Encrypt ePHI in transit and at rest to guard against unauthorized access to ePHI when appropriate."
• "Incorporate lessons learned from incidents into the organization's overall security management process."
• Provide workforce members with regular HIPAA training specific to the organization and to their job duties.

The Risk Analysis Initiative

In fall 2024 OCR launched a Risk Analysis Initiative: investigations focused specifically on whether the organization had done the risk analysis 45 CFR 164.308(a)(1)(ii)(A) requires. The first action, announced October 31, 2024, was Bryan County Ambulance Authority in Oklahoma: $90,000 and a three-year CAP after a ransomware attack in late November 2021 that affected about 14,273 patients.¹⁶ OCR's April 23, 2026 release said it had completed 13 Risk Analysis Initiative investigations, and the June 18, 2026 Spencer Gifts settlement was the 14th.⁵⁰⁴⁶ Later 2026 releases, including OSF and Ambry Genetics, cite risk analysis failures without stating an initiative number, so the accurate statement is "at least 14 Risk Analysis Initiative enforcement actions as of June 18, 2026."

Named examples from the initiative show how small the organizations can be:

• 11th: Top of the World Ranch Treatment Center, an Illinois substance use disorder treatment provider, $103,000, February 19, 2026, after a phishing attack affecting 1,980 patients.⁵⁴
• 12th: MMG Fusion, a business associate, $10,000, March 5, 2026.⁸
• Earlier actions reported in a compiled list include Northeast Radiology ($350,000, April 2025), Health Fitness Corporation ($227,816, March 2025) and BST and Co. CPAs ($175,000, August 2025, the 10th action per OCR), alongside the smaller ransomware cases above.⁵²

If the risk analysis is the thing OCR asks for first, it is also the thing a practice should spend its first compliance dollars on. Lesson 4 walks through how to do one that would survive an OCR data request.

Right of Access enforcement

Not every OCR case is about hackers. In 2019 OCR announced a Right of Access Initiative to enforce patients' right under 45 CFR 164.524 to get copies of their records within 30 days (with one 30-day extension) for a reasonable, cost-based fee. The first action was Bayfront Health St. Petersburg, $85,000, in September 2019.⁴⁵ The 55th, announced August 27, 2026, was Azul Vision, Inc., a California optometry and ophthalmology practice, which paid $50,000 after a patient who requested records in January 2023 did not receive them until January 2025.⁵⁵ Other examples on OCR's list include a $200,000 civil money penalty against Oregon Health and Science University (March 6, 2025), a $100,000 penalty against a mental health center (November 19, 2024) and a $70,000 penalty against Gums Dental Care (October 17, 2024).⁴⁵

On October 8, 2026, OCR announced a $140,000 settlement with Dr. Linda L. Shen, doing business as Shen Smiles, P.C., a Pennsylvania dental practice, in a Privacy Rule investigation that started with a complaint about failure to provide timely access. OCR found the practice had no Privacy Rule or Breach Notification Rule policies and procedures, including right of access policies, and had not reasonably safeguarded protected health information. OCR called it the 56th enforcement action in its Right of Access Initiative.⁵⁶

Access cases are worth attention because they are the easiest HIPAA violations for patients to spot and prove, and because they are cheap to prevent: a written procedure, a log of requests with dates, and someone responsible for meeting the deadline.

Recent 2026 actions at a glance

Sources: the OCR press releases cited above.^54505556

Hospital and health system ransomware: the case studies

OCR settlements tell you what the government found years later. The incidents themselves tell you what the attacks did to care. The cases below are told from primary sources where they exist (OCR, congressional records, company filings) and from named news reports where they do not. Where a figure comes from a trade publication or a filing with a state attorney general, the note says so.

Change Healthcare, February 2024

Change Healthcare, a UnitedHealth Group subsidiary, is a health care clearinghouse: it moves claims, eligibility checks, prior authorizations and pharmacy transactions between providers, pharmacies and health plans. That position is what made the attack so damaging.

• How it started. UnitedHealth Group chief executive Andrew Witty told the Senate Finance Committee on May 1, 2024 that the attackers entered "a Change Healthcare portal," that "the portal they accessed was not protected by multifactor authentication," and that ransomware was deployed on February 21, roughly nine days after entry.⁵⁷ His written testimony, as reported by The Register, identified the portal as a Citrix remote access portal and the attackers as affiliates of the ALPHV group, using compromised credentials, with initial access on February 12.⁵⁸
• The ransom. Asked at the hearing how much was paid, Witty answered: "Twenty-two million dollars." He said the decision "was mine."⁵⁷
• The effect on care and cash. Claims, eligibility and pharmacy transactions that ran through Change stopped or slowed for weeks. In an American Hospital Association survey of nearly 1,000 hospitals taken March 9 to 12, 2024, 74% reported a direct impact on patient care, 94% reported a financial impact, and 67% said switching clearinghouses was difficult or very difficult.⁵⁹ Witty told the committee UnitedHealth had advanced "more than $6.5 billion in accelerated payments and no-interest, no-fee loans to thousands of providers," and that core systems including pharmacy, claims and payments were back.⁵⁷ Chairman Ron Wyden said: "This hack could have been stopped with cybersecurity 101."
• The count. Change filed its breach report on July 19, 2024 with a placeholder figure of 500. By October 22, 2024 it had sent about 100 million notices; by January 24, 2025, about 190 million people were affected; and as of July 31, 2025, about 192.7 million, according to OCR's Change Healthcare FAQ.⁶⁰ OCR's report to Congress for 2024 lists the largest breach of that year at about 192,000,000, "ransomware at a health care clearinghouse," and counts 663 large breaches affecting about 242.9 million individuals in 2024 overall.⁶¹
• Enforcement. OCR opened investigations of Change Healthcare and UnitedHealth Group and published a Dear Colleague letter on March 13, 2024.⁶⁰ As of October 28, 2026, OCR had announced no settlement or penalty against either. Nebraska's state lawsuit, described above, survived a motion to dismiss in November 2025; this lesson found no reported resolution as of October 28, 2026.⁴²

Two lessons from Change matter to small practices. First, a business associate failure can be your outage: practices that sent all claims through Change could not bill. Second, OCR's FAQ said a covered entity "may delegate to its business associate the tasks of providing the required" notifications, and that covered entities that confirmed Change would notify for them would have no additional breach notice duties if the notices were properly made.⁶⁰ The duty still started with the covered entity, so agreements with clearinghouses and other vendors should say who notifies whom and how fast (see lesson 6).

Ascension, May 2024

Ascension, one of the largest nonprofit health systems in the country with about 140 hospitals, detected ransomware on May 8, 2024. Hospitals across its system went to downtime procedures, and some diverted emergency medical services.⁶² Ascension later said the attacker got in after an employee at one of its facilities accidentally downloaded a malicious file.⁶³ Electronic health records were largely back by June 11 and expected fully restored by June 14, 2024.⁶⁴ In a filing with the Maine attorney general, Ascension reported that 5,599,699 people, patients and employees, were affected by the data theft. CNN reported, citing sources, that the Black Basta group was responsible; Ascension did not confirm that.⁶²

CommonSpirit Health, 2022

Attackers had unauthorized access to CommonSpirit Health systems from September 16 to October 3, 2022, and the system reported 623,774 affected people to the HHS breach portal on December 8, 2022. The system's reported cost was about $160 million.⁴⁸

Scripps Health, May 2021

Scripps Health in San Diego was hit by ransomware in May 2021. Hackers stole information from about 147,267 people before encrypting systems, and the system's cost was reported at almost $113 million in lost revenue and recovery.⁴⁷ The Scripps attack later became the subject of one of the most cited studies of what ransomware does to patients outside the hospital that was hit (see the next section).⁶⁵

2025 and 2026

Large health care breaches did not slow down. HIPAA Journal's June 2026 tally of the largest breaches of 2025 lists, among others, Conduent Business Services, a business associate, at 62,224,658 people; Yale New Haven Health at 5,556,702 (hacking); DaVita at 2,689,826 (ransomware); and Kettering Adventist Healthcare at 1,695,382 (ransomware).⁶⁶ Those totals are as reported in June 2026 and may change as entities update their reports. For 2026 through July 31, HIPAA Journal counted 67,400,422 people affected, with 86% of large breaches (414) classed as hacking or IT incidents; the largest July breach was DentaQuest, about 15 million.⁶⁷

Idaho has had its own. Kootenai Health in Coeur d'Alene reported data exfiltrated around February 22, 2024 and identified March 2, 2024, affecting 464,088 people per its Maine attorney general filing; the 3AM ransomware group claimed it.⁶⁸ Weiser Memorial Hospital identified unusual network activity on September 4, 2024 and, after a file review that ended April 21, 2025, reported 59,990 people affected.⁶⁹ Minidoka Memorial Hospital in Rupert was hit on Easter morning 2026 and reported up to 22,000 patients to OCR, according to HIPAA Journal; it filed notices with the Idaho attorney general on August 6 and September 28, 2026.⁷⁰⁷¹ In July 2026, Boundary Regional Community Health Center (Kaniksu Community Health) reported 88,000 people affected through hacking at its business associate, Aesto Health.⁶⁷

What ransomware does to patients

When a hospital's systems go down, two terms show up in the news: downtime procedures and ambulance diversion.

• Downtime procedures are the hospital's plan for working without its electronic systems: paper charts and orders, printed medication lists, runners carrying lab results, manual registration, phone calls in place of electronic messages. Every hospital is supposed to have them and drill them. In a short outage they work. In an outage of weeks, they slow everything down: medication reconciliation, imaging reads, lab turnaround and discharge.
• Ambulance diversion means the hospital asks emergency medical services to take patients elsewhere, usually because it cannot safely receive more, for example because imaging or the electronic record is down. Walk-in patients can still come to the emergency department; diversion changes where ambulances go. In a rural area, the next hospital may be an hour away.

What does the research show? Two studies are worth knowing, with their limits.

• Neighboring emergency departments. Dameff and colleagues at UC San Diego, writing in JAMA Network Open in May 2023, compared two emergency departments at a health system next to the one that was attacked in May 2021 (news coverage identified the attacked system as Scripps). During the four weeks of attack and recovery, compared with the four weeks before, mean daily emergency census rose from 218.4 to 251.4 and median waiting room time from 21 to 31 minutes, while over each four-week period ambulance arrivals rose from 1,741 to 2,354, patients who left without being seen from 158 to 360, stroke code activations from 59 to 103 and confirmed strokes from 22 to 47.⁷²⁶⁵ Coverage of the study stressed its point that an attack on one health system disrupts care across a whole region.
• Patients inside the attacked hospital. University of Minnesota health economists Hannah Neprash, Claire McGlave and Sayeh Nikpay linked a database of hospital ransomware attacks to Medicare claims. In the peer-reviewed version of their study, published in American Economic Journal: Economic Policy in February 2026, they estimate that attacks reduce hospital volume by about 17 to 24 percent in the first week of an attack, with recovery within about three weeks, and that in-hospital mortality rises by an estimated 34 to 38 percent among patients who were already admitted when the attack began.⁷³ An earlier working-paper version gave somewhat different ranges; Neprash told NPR in 2023 that in-hospital mortality "goes up about 20 to 35%" for those patients, while noting the work had not yet completed peer review.⁷⁴ Treat the published 34 to 38 percent figure as a statistical estimate for Medicare inpatients across many attacks: it is an average effect from one study, not a count of deaths at any hospital, and it covers Medicare patients only.

Neither study proves that any particular patient died because of an attack, and this lesson does not make that claim about any case. They do support a narrower point that both sides of the policy debate accept: hospital cybersecurity is a patient safety issue, not just a privacy issue.

What the patterns in OCR cases show

Read 20 resolution agreements in a row and the same handful of failures appear. These are OCR's findings, not guesses.

The proposed Security Rule update (90 FR 898, January 6, 2025) would turn several of these from judgment calls into explicit requirements: multifactor authentication and encryption with limited exceptions, an asset inventory and network map, vulnerability scans every six months and penetration tests every year, and 72-hour restoration plans. As of October 28, 2026 it is still a proposal, with final action projected for July 2027.³⁴³⁵ Under the current rule, OCR reaches the same failures through the risk analysis and risk management standards.

Common mistakes, from the cases

• Treating a vendor's security questionnaire or a checklist as the risk analysis. OCR wants an accurate and thorough assessment of the organization's own risks to all of its electronic protected health information, wherever it is. MMG Fusion, a business associate, settled over a potential failure to conduct exactly that kind of risk analysis, with a three-year corrective action plan.⁸
• Doing the risk analysis once. OSF's CAP requires annual risk analyses for two years. The Security Rule requires security measures to be reviewed and modified as needed (45 CFR 164.306(e)), which in practice means after major changes and incidents as well as on a schedule.¹⁴
• Waiting to finish the forensic review before notifying. OSF's late notices to patients and to HHS were part of its covered conduct. The 60-day outer limit runs from discovery, not from the end of the investigation (lesson 5).¹⁴
• Assuming a health plan's employer sponsor is not involved. Spencer Gifts' and Star Group's group health plans were the covered entities that settled; employer-sponsored plans are covered entities in their own right.⁴⁶⁵⁰
• Ignoring records requests. Azul Vision took two years to deliver records; Shen Smiles had no access policy at all.⁵⁵⁵⁶
• Keeping old accounts alive. Ambry Genetics did not terminate access and did not assign unique user IDs.¹¹
• No logging or no one watching. Doctors' Management Services' intruder was inside for about 20 months before the ransomware went off.¹⁵
• Believing a small size means no enforcement. OCR settled with a ground ambulance authority for $90,000, a surgical group for $10,000 and a neurology practice for $25,000, each with years of monitoring.¹⁶⁴⁵

Questions people ask

Will OCR really go after a small practice?

Yes, though rarely with large dollar amounts. OCR's 2025 and 2026 actions include a $10,000 settlement with Northeast Surgical Group, $25,000 with a neurology practice and with Guam Memorial Hospital Authority, $50,000 with Azul Vision and $140,000 with a Pennsylvania dental practice, Shen Smiles. Each came with a corrective action plan, usually two years, sometimes three.⁴⁵⁵⁵⁵⁶ Most small-practice complaints end in technical assistance, but a breach report of 500 or more people opens a review, because OCR says it investigates all of them.⁵

Can a patient sue under HIPAA?

No. HIPAA gives individuals no private right to sue; only HHS and state attorneys general can enforce it. Patients do sue after breaches, often in class actions, under state negligence, contract, consumer protection and privacy laws. HIPAA's standards can show up in those cases as evidence of what reasonable care looks like.

Does paying a ransom violate HIPAA?

HIPAA does not prohibit or require paying a ransom. The breach analysis and notice duties are the same either way: paying does not undo the presumption that a ransomware attack is a breach.⁵³ Paying can raise other federal issues, such as sanctions rules if the attackers are on a sanctions list, which are outside this lesson.

Why do settlements take five years?

Because OCR investigations are document-heavy, OCR's staff is small relative to the volume of breach reports, and many organizations negotiate. OSF's 2021 attack produced a 2026 settlement; Ambry's January 2020 phishing incident, a September 2026 one.¹⁰¹¹ OCR's 2024 report to Congress also noted it had no money to start audits that year.⁶

Is a resolution agreement an admission of guilt?

No. The standard agreement states that it is "not an admission of liability," and HHS does not concede that no violation occurred. Report the payment and OCR's findings of "potential violations," not a verdict.¹⁴

Where does the settlement money go? Do victims get any?

Under HITECH, penalty and settlement money goes to OCR's HIPAA enforcement work; patients receive nothing directly. HITECH also directed HHS to set up a method for sharing a percentage of penalties and settlements with harmed individuals. HHS asked for public comment on that, and on recognized security practices, in a request for information on April 6, 2022, and its 2026 regulatory agenda projects a proposed rule (RIN 0945-AA04) for November 2027.⁷⁵³⁵

Can the state and OCR both act on the same breach?

Yes. Anthem paid OCR $16 million in 2018 and a multistate group of attorneys general $39.5 million in 2020 over the same 2015 breach.⁴³⁴⁰ Under 42 U.S.C. 1320d-5(d), a state may not bring a HIPAA action over a violation while a federal action on it is pending, but state-law claims are separate.²⁰

Hard questions

Are OCR's penalties too low to change behavior?

The case that they are too low: MMG Fusion paid $10,000 over an intrusion affecting about 15 million people, and the 2019 caps limit reasonable-cause penalties to about $146,053 a year per provision even for a large health system. Against ransomware recovery costs in the tens or hundreds of millions, and against the time it takes OCR to act, a fine five years later is a weak signal. Supporters of tougher enforcement point to Change Healthcare: the largest breach ever reported, with no OCR action announced more than two and a half years later.⁸²⁵⁶⁰

The case that they are about right: Most covered entities are small, many run at thin margins, and the statute itself tells HHS to weigh financial condition. A large fine against a rural hospital can take money from care. The CAP, not the payment, is what changes practice, and the ransomware recovery costs already give organizations a far larger reason to invest than any fine could.

What the evidence shows: OCR collected $9,944,612 from 22 resolutions in 2024, while 2024 large breaches affected about 242.9 million records.⁶⁶¹ There is no published study isolating the deterrent effect of OCR fines. The patterns in OCR cases (the same failures year after year) suggest that many organizations are not learning from published settlements.

Should the Security Rule mandate multifactor authentication and encryption?

For a mandate: The Change Healthcare attack began at a remote portal without multifactor authentication, by the company's own testimony, and the MD Anderson court said HHS could write a stricter encryption rule if it wanted one. A clear rule would make enforcement simpler and fairer. HHS proposed exactly that in January 2025.⁵⁷³²³⁴

Against a mandate, or for more flexibility: On February 21, 2025, a coalition of health care groups including the Association of American Medical Colleges asked the administration to rescind the proposal, citing its "staggering costs and regulatory burden" and an "unreasonable" timeline, and warning that compliance spending would divert money from patient care.⁷⁶ HHS's own estimate of first-year cost was about $9.3 billion, a widely reported figure from the proposal's impact analysis. Opponents also point out that legacy clinical systems and some medical devices cannot support multifactor authentication or encryption, and they favor voluntary goals and incentives such as the HHS Cybersecurity Performance Goals and the recognized security practices credit.⁷⁷³⁰

What the evidence shows: Multifactor authentication and encryption both appear among HHS's ten "essential" voluntary performance goals, so HHS's own guidance treats them as baseline. Whether a mandate will happen is open: the rule remains a proposal, listed as a long-term action with final action projected for July 2027.⁷⁷³⁵

Should OCR say more, sooner, about open investigations?

For more disclosure: Patients, reporters and lawmakers learn nothing official between a breach report and a settlement years later. Faster public findings would help patients judge where to get care and help other organizations learn.

Against: Investigations depend on cooperation, early findings can be wrong, and publicity before a finding can punish an organization that turns out to have done little wrong, as the MD Anderson inconsistency holding shows.³²

What the evidence shows: The breach portal already shows reported breaches under investigation, and OCR's resolution agreements are detailed once published. The gap is timing, and it is a resource question as much as a policy one.⁵⁶

Should large clearinghouses and other vendors face more direct oversight?

For: In 2024, breaches involving a business associate were 16% of large breach reports but affected 85% of the individuals, about 206.9 million people, largely because of Change Healthcare.⁶¹ A few vendors sit in the middle of the system and their failure stops care everywhere.

Against more rules: Business associates are already directly liable under the Security Rule, and OCR already settles with them (MMG Fusion, Consociate Health, BST and Co.). More rules may add cost without adding capacity to enforce them.⁸⁵⁰

What the evidence shows: The concentration risk is real and measurable in OCR's own numbers. The NPRM would add 24-hour contingency plan notice from business associates and annual verification of their safeguards; it is not final.³⁴

Where to go next

• HHS OCR Breach Portal: Free public list of HIPAA and Part 2 breaches affecting 500 or more people, kept by OCR. For reporters, advocates and compliance staff. Filter by state, export to a spreadsheet and compare with state attorney general notices.
• OCR Resolution Agreements and Civil Money Penalties: Free list of every OCR settlement and penalty with links to the full agreements. Read the covered conduct and the corrective action plan of cases like yours.
• HHS OCR Enforcement Highlights: Free OCR summary of complaints, resolutions and DOJ referrals since 2003 (data as of Oct. 31, 2024). Use it for context, not for current-year counts.
• HHS Security Risk Assessment Tool: Free HHS tool (version 3.7) for small and medium practices to conduct the risk analysis OCR asks for first. Runs on Windows or as an Excel workbook; data stays on your computer.
• HHS 405(d) Health Industry Cybersecurity Practices: Free HHS guide to the five main threats and ten practices; one of the recognized security practice sets OCR must consider under 42 U.S.C. 17941.
• HHS FOIA requests: Free. Where to file Freedom of Information Act requests for OCR records; describe the entity, dates and records you want, and ask for a fee waiver if you qualify.
• Idaho Attorney General security breach notices: Free list of breach notices filed with the Idaho attorney general under Idaho Code 28-51-105; check it alongside the HHS portal for Idaho cases.

Still being checked (10 items)

These points could not be fully confirmed against a primary source when this lesson was written and fact checked in October 2026. The text above states each one as uncertain.

• The inflation-adjusted 2019 enforcement discretion caps ($36,505.50, $146,053, $365,052 and $2,190,294) come from HIPAA Journal; HHS's Federal Register table does not print them.
• Whether OCR's 2024 to 2025 audit round of about 50 entities, reported by trade press, has produced any results; OCR's own 2024 report says no audits were initiated in 2024.
• The Risk Analysis Initiative count after June 18, 2026 (14th action); later releases give no number.
• Some 2025 settlement amounts (for example several Risk Analysis Initiative actions such as Northeast Radiology and Health Fitness Corporation) come from secondary compilations rather than OCR releases read for this lesson.
• No OCR action against Change Healthcare or UnitedHealth Group, and no Idaho attorney general HIPAA suit, was found; this is absence of evidence as of Oct. 28, 2026.
• Ascension's affected count, Scripps and CommonSpirit costs, Idaho hospital counts and 2025 to 2026 breach totals come from filings and trade press, not OCR.
• HHS's estimated first-year cost of the Security Rule proposal (about $9.3 billion) is widely reported but was not read in the HHS primary document for this lesson.
• The 2023 NPR figure of 20 to 35% higher in-hospital mortality is from an interview about the pre-publication working paper; the published February 2026 article reports 34 to 38 percent.
• The projected November 2027 date for a proposed rule on sharing penalties with harmed individuals (RIN 0945-AA04) is taken from a law firm summary (Davis Wright Tremaine) of the Unified Agenda, not read directly on reginfo.gov.
• The Nebraska v. Change Healthcare case status after the November 2025 denial of the motion to dismiss could not be confirmed from court records; no later resolution was found.

Last verified October 28, 2026. General education, not legal, compliance or medical advice; rule versions and dates are stated in the text, and the sources used are listed in the Notes and Sources below. Check the regulator's current text before relying on any point.

Notes

1. HHS, "42 CFR Part 2" overview page, content last reviewed Sept. 29, 2026 (OCR enforcement of Part 2 from Feb. 16, 2026; enforcement follows 45 CFR Part 160, Subparts C, D and E) (read Oct. 28, 2026). Read it online. ↩
2. HHS, "Paula M. Stannard, Director, Office for Civil Rights," leadership page (read Oct. 28, 2026). Read it online. ↩
3. Electronic Code of Federal Regulations, 45 CFR Part 160, General Administrative Requirements, Subparts C (Compliance and Investigations), D (Imposition of Civil Money Penalties) and E (Procedures for Hearings), current text as amended through 78 FR 5566 (Jan. 25, 2013) and later inflation rules (read Oct. 28, 2026). Read it online. ↩
4. 45 CFR 160.306, Complaints to the Secretary, as amended 78 FR 5690 (Jan. 25, 2013), Cornell Legal Information Institute text (read Oct. 28, 2026). Read it online. ↩
5. HHS OCR Breach Portal, landing page: OCR "investigates all breaches of protected health information (PHI) and Part 2 records that affect 500 or more individuals" (read Oct. 28, 2026). Read it online. ↩
6. HHS OCR, Annual Report to Congress on HIPAA Privacy, Security, and Breach Notification Rule Compliance for Calendar Year 2024 (30,256 complaints; 730 compliance reviews, 665 from breach reports; 22 resolutions totaling $9,944,612; no audits initiated in 2024) (read Oct. 28, 2026). Read it online. ↩
7. 45 CFR 160.308, Compliance reviews, as amended 78 FR 5690 (Jan. 25, 2013) (read Oct. 28, 2026). Read it online. ↩
8. HHS OCR press release, MMG Fusion, LLC HIPAA resolution agreement ($10,000; 12th Risk Analysis Initiative action; financial condition considered; three-year CAP), Mar. 5, 2026 (read Oct. 28, 2026). Read it online. ↩
9. TechTarget, "How to prepare for OCR's HIPAA audit program," Mar. 31, 2025 (audits resumed December 2024, about 50 entities; phase two 2016 to 2017 covered 166 covered entities and 41 business associates; November 2024 HHS OIG recommendations). Secondary source (read Oct. 28, 2026). Read it online. ↩
10. HHS OCR press release on the OSF HealthCare System ransomware settlement ($552,250; 21st ransomware enforcement action), July 29, 2026 (read Oct. 28, 2026). Read it online. ↩
11. HHS OCR press release, Ambry Genetics settlement ($700,000; phishing attack affecting 225,370 individuals), Sept. 17, 2026 (read Oct. 28, 2026). Read it online. ↩
12. 45 CFR 160.312, Secretarial action regarding complaints and compliance reviews, as amended 78 FR 5690 (Jan. 25, 2013) (read Oct. 28, 2026). Read it online. ↩
13. HHS OCR, "Enforcement Highlights," data as of Oct. 31, 2024 (latest posted) (read Oct. 28, 2026). Read it online. ↩
14. Resolution Agreement and Corrective Action Plan between HHS OCR and OSF Healthcare System, signed July 1, 2026 (read Oct. 28, 2026). Read it online. ↩
15. Nixon Peabody, "OCR reaches first ransomware settlement," Nov. 28, 2023 (Doctors' Management Services, $100,000, announced Oct. 31, 2023; three-year CAP). Secondary source (read Oct. 28, 2026). Read it online. ↩
16. HHS OCR, Bryan County Ambulance Authority resolution agreement and corrective action plan ($90,000; first Risk Analysis Initiative action, Oct. 31, 2024). Details as summarized in the module fact sheet from secondary reports (read Oct. 28, 2026). Read it online. ↩
17. 45 CFR 160.504, Hearing before an ALJ (90-day request deadline) (read Oct. 28, 2026). Read it online. ↩
18. 45 CFR 160.548, Appeal of the ALJ's decision, and 45 CFR 160.502, definition of "Board" (read Oct. 28, 2026). Read it online. ↩
19. 45 CFR 160.404, Amount of a civil money penalty, as amended 78 FR 5690 (Jan. 25, 2013), with amounts adjusted at 45 CFR 102.3 (read Oct. 28, 2026). Read it online. ↩
20. 42 U.S.C. 1320d-5, General penalty for failure to comply with requirements and standards (tiers at (a)(3); 30-day cure at (b)(2); waiver at (b)(3); state attorney general actions at (d)) (read Oct. 28, 2026). Read it online. ↩
21. 45 CFR 160.401, Definitions (reasonable cause, reasonable diligence, willful neglect), as amended 78 FR 5690 (Jan. 25, 2013) (read Oct. 28, 2026). Read it online. ↩
22. HHS, "Annual Civil Monetary Penalties Inflation Adjustment," final rule, 91 FR 3665 (Jan. 28, 2026), RIN 0991-AC38, amending 45 CFR 102.3 (read Oct. 28, 2026). Read it online. ↩
23. HHS notice cancelling the 2026 civil monetary penalty inflation adjustment, FR Doc. 2026-21524, 91 FR 66566 to 66567 (Oct. 21, 2026), in the Federal Register issue of that date; the notice cites OMB Memorandum M-26-11 of April 17, 2026 (read Oct. 28, 2026). Read it online. ↩
24. HIPAA Journal, report on the HHS notice of no 2026 penalty adjustment, Oct. 22, 2026. Secondary source (read Oct. 28, 2026). Read it online. ↩
25. HIPAA Journal, "What are the Penalties for HIPAA Violations?" updated Oct. 22, 2026 (inflation-adjusted Notice of Enforcement Discretion caps). Secondary source; HHS does not publish these adjusted caps in its Federal Register table (read Oct. 28, 2026). Read it online. ↩
26. HHS, "Notification of Enforcement Discretion Regarding HIPAA Civil Money Penalties," 84 FR 18151 (Apr. 30, 2019) (read Oct. 28, 2026). Read it online. ↩
27. 45 CFR 160.406, Violations of an identical requirement or prohibition (read Oct. 28, 2026). Read it online. ↩
28. 45 CFR 160.408, Factors considered in determining the amount of a civil money penalty (read Oct. 28, 2026). Read it online. ↩
29. 45 CFR 160.410, Affirmative defenses (read Oct. 28, 2026). Read it online. ↩
30. 42 U.S.C. 17941, Recognition of security practices (HITECH section 13412, added by Pub. L. 116-321, Jan. 5, 2021) (read Oct. 28, 2026). Read it online. ↩
31. HHS 405(d) Program, Health Industry Cybersecurity Practices: Managing Threats and Protecting Patients, 2023 edition (read Oct. 28, 2026). Read it online. ↩
32. University of Texas M.D. Anderson Cancer Center v. U.S. Department of Health and Human Services, No. 19-60226 (5th Cir. Jan. 14, 2021) (Oldham, J.) (read Oct. 28, 2026). Read it online. ↩
33. Covington and Burling, "M.D. Anderson Wins Appeal Over $4.3 Million HIPAA Penalty," Inside Privacy blog, Feb. 8, 2021 (ALJ upheld penalty June 2018; DAB affirmed). Secondary source (read Oct. 28, 2026). Read it online. ↩
34. HHS, "HIPAA Security Rule Notice of Proposed Rulemaking to Strengthen Cybersecurity for Electronic Protected Health Information" fact sheet, Dec. 27, 2024 (NPRM published 90 FR 898, Jan. 6, 2025) (read Oct. 28, 2026). Read it online. ↩
35. Office of Information and Regulatory Affairs, Unified Agenda entry RIN 0945-AA22 (long-term action, final action 07/2027); related entries RIN 0945-AA04 (distribution of CMPs and settlements, proposed rule projected November 2027) as summarized by Davis Wright Tremaine, July 2026 (read Oct. 28, 2026). Read it online. ↩
36. 42 U.S.C. 1320d-6, Wrongful disclosure of individually identifiable health information (read Oct. 28, 2026). Read it online. ↩
37. U.S. Attorney's Office, Western District of Pennsylvania, "Butler Woman to Serve a Year in Prison for Maliciously Disclosing Personally Identifiable Health Information," June 25, 2019 (read Oct. 28, 2026). Read it online. ↩
38. U.S. Attorney's Office, Southern District of Iowa, "Des Moines Man Sentenced to 27 Months in Prison for Criminal HIPAA Violations," June 29, 2022 (read Oct. 28, 2026). Read it online. ↩
39. New Hampshire Department of Justice, news release on the 33-state Inmediata settlement ($1.4 million), Oct. 17, 2023 (read Oct. 28, 2026). Read it online. ↩
40. Ohio Attorney General, news release, "Attorney General Yost Approves $39.5 Million Multistate Settlement" with Anthem, Sept. 30, 2020 (read Oct. 28, 2026). Read it online. ↩
41. Nebraska Examiner, "AG sues Change Healthcare, two other companies after data breach hits at least 575,000 Nebraskans," Dec. 16, 2024. Secondary source (read Oct. 28, 2026). Read it online. ↩
42. Becker's Hospital Review, "Nebraska AG's lawsuit over Change Healthcare breach moves forward," Nov. 14, 2025. Secondary source (read Oct. 28, 2026). Read it online. ↩
43. HHS OCR, Anthem, Inc. $16 million record HIPAA settlement announcement, Oct. 15, 2018 (read Oct. 28, 2026). Read it online. ↩
44. HHS OCR, Premera Blue Cross $6.85 million settlement announcement, Sept. 25, 2020 (read Oct. 28, 2026). Read it online. ↩
45. HHS OCR, "Resolution Agreements and Civil Money Penalties" list (Montefiore, Solara, Warby Parker, Gulf Coast Pain Consultants, Children's Hospital Colorado, Providence Medical Institute, Oregon Health and Science University, Northeast Surgical Group, Guam Memorial Hospital Authority, Comprehensive Neurology, Comstar, Syracuse ASC, Gums Dental Care and others) (read Oct. 28, 2026). Read it online. ↩
46. HHS OCR press release, Spencer Gifts LLC Flexible Benefits and Welfare Benefit Plans settlement ($450,000; 20th ransomware and 14th Risk Analysis Initiative action), June 18, 2026 (read Oct. 28, 2026). Read it online. ↩
47. Fierce Healthcare, "Before attacking IT systems, hackers stole information from 147,000 patients: Scripps Health," 2021. Secondary source (read Oct. 28, 2026). Read it online. ↩
48. BleepingComputer, "CommonSpirit Health ransomware attack exposed data of 623,000 patients," December 2022; reported cost about $160 million from later trade coverage. Secondary source (read Oct. 28, 2026). Read it online. ↩
49. HHS OCR press release, "HHS Office for Civil Rights Settles 8th Ransomware Investigation with Elgon Information Systems," Jan. 7, 2025 (9th, Virtual Private Network Solutions, announced the same day) (read Oct. 28, 2026). Read it online. ↩
50. HHS OCR press release, "OCR Settles Four Ransomware Investigations" (19 completed ransomware and 13 Risk Analysis Initiative investigations), Apr. 23, 2026 (read Oct. 28, 2026). Read it online. ↩
51. HHS OCR press release, BST and Co. CPAs, LLP ransomware settlement, Aug. 18, 2025 ($175,000; 15th ransomware and 10th Risk Analysis Initiative enforcement action) (read Oct. 28, 2026). Read it online. ↩
52. EHR Resources, "OCR Risk Analysis Initiative" compiled list of actions, Oct. 18, 2026 (Northeast Radiology, Health Fitness Corporation, Comprehensive Neurology and others). Secondary source (read Oct. 28, 2026). Read it online. ↩
53. Ropes and Gray, "HHS Issues New Guidance on Ransomware," July 2016, summarizing OCR's July 11, 2016 ransomware guidance. Secondary source (read Oct. 28, 2026). Read it online. ↩
54. HHS OCR press release, Top of the World Ranch Treatment Center settlement ($103,000; 11th Risk Analysis Initiative action), Feb. 19, 2026 (read Oct. 28, 2026). Read it online. ↩
55. HHS OCR press release, Azul Vision, Inc. settlement ($50,000; 55th Right of Access enforcement action), Aug. 27, 2026 (read Oct. 28, 2026). Read it online. ↩
56. HHS OCR press release, Dr. Linda L. Shen d/b/a Shen Smiles, P.C. settlement ($140,000; 56th Right of Access enforcement action), Oct. 8, 2026 (read Oct. 28, 2026). Read it online. ↩
57. U.S. Senate Committee on Finance, hearing record, "Hacking America's Health Care: Assessing the Change Healthcare Cyber Attack and What's Next," May 1, 2024, S. Hrg. 118-785 (testimony of Andrew Witty; statement of Chairman Wyden) (read Oct. 28, 2026). Read it online. ↩
58. The Register, report of Apr. 30, 2024 quoting Andrew Witty's written testimony (Citrix portal, compromised credentials, Feb. 12 access, ALPHV affiliates). Secondary source (read Oct. 28, 2026). Read it online. ↩
59. American Hospital Association, "AHA Survey: Change Healthcare Cyberattack Significantly Disrupts Patient Care, Hospitals' Finances," Mar. 15, 2024 (responses Mar. 9 to 12, 2024) (read Oct. 28, 2026). Read it online. ↩
60. HHS OCR, "Change Healthcare Cybersecurity Incident Frequently Asked Questions," content last reviewed Aug. 13, 2025 (about 192.7 million individuals as of July 31, 2025; delegation of notification, FAQ 7) (read Oct. 28, 2026). Read it online. ↩
61. HHS OCR, Annual Report to Congress on Breaches of Unsecured Protected Health Information for Calendar Year 2024 (663 breaches of 500 or more affecting about 242,908,056 individuals; business associate involvement in 106 reports affecting 206,921,071) (read Oct. 28, 2026). Read it online. ↩
62. SecurityWeek, "5.6 Million Impacted by Ransomware Attack on Healthcare Giant Ascension," December 2024 (Maine attorney general filing; EMS diversion; downtime procedures; Black Basta attribution reported by CNN). Secondary source (read Oct. 28, 2026). Read it online. ↩
63. CBS News Detroit, "Ascension cyberattack caused after employee accidentally downloaded malicious file," June 13, 2024. Secondary source (read Oct. 28, 2026). Read it online. ↩
64. Fierce Healthcare, "Ascension ransomware attack exposes data on 5.6M patients, employees," December 2024 (EHR restoration by June 14, 2024). Secondary source (read Oct. 28, 2026). Read it online. ↩
65. Chief Healthcare Executive, "How the Scripps Health cyberattack affected other hospitals," May 11, 2023. Secondary source (read Oct. 28, 2026). Read it online. ↩
66. HIPAA Journal, "Largest Healthcare Data Breaches of 2025," June 5, 2026. Secondary source; totals may change (read Oct. 28, 2026). Read it online. ↩
67. HIPAA Journal, "July 2026 Healthcare Data Breach Report," Oct. 15, 2026 (2026 year to date; DentaQuest; Boundary Regional Community Health Center and Aesto Health). Secondary source (read Oct. 28, 2026). Read it online. ↩
68. SecurityWeek, report on the Kootenai Health ransomware attack (464,088 people, Maine attorney general filing; 3AM group claim), August 2024. Secondary source (read Oct. 28, 2026). Read it online. ↩
69. HIPAA Journal, report on the Weiser Memorial Hospital data breach, May 15, 2025. Secondary source (read Oct. 28, 2026). Read it online. ↩
70. HIPAA Journal, report on the Minidoka Memorial Hospital cyberattack, Apr. 22, 2026. Secondary source (read Oct. 28, 2026). Read it online. ↩
71. Idaho Office of the Attorney General, Security Breaches notice list (Minidoka Memorial Hospital filings Aug. 6 and Sept. 28, 2026) (read Oct. 28, 2026). Read it online. ↩
72. Christian Dameff, Jeffrey Tully, Theodore C. Chan and others, "Ransomware Attack Associated With Disruptions at Adjacent Emergency Departments in the US," JAMA Network Open 6(5): e2312270 (May 2023), doi:10.1001/jamanetworkopen.2023.12270 (read Oct. 28, 2026). Read it online. ↩
73. Hannah Neprash, Claire McGlave and Sayeh Nikpay, "Hacked to Pieces? The Effects of Ransomware Attacks on Hospitals and Patients," American Economic Journal: Economic Policy 18(1): 256-81 (February 2026), doi:10.1257/pol.20240594 (earlier working paper SSRN 4579292) (read Oct. 28, 2026). Read it online. ↩
74. NPR, transcript of 2023 report on ransomware attacks against hospitals, quoting Hannah Neprash ("goes up about 20 to 35%"; not yet peer reviewed) (read Oct. 28, 2026). Read it online. ↩
75. HHS press release, "HHS Office for Civil Rights Seeks Public Comment on Recognized Security Practices and Sharing Civil Money Penalties, Monetary Settlements under the HITECH Act," Apr. 6, 2022 (read Oct. 28, 2026). Read it online. ↩
76. Association of American Medical Colleges, "AAMC Joins Group Letter Requesting Rescission of HIPAA Proposed Security Rule," Feb. 21, 2025 (read Oct. 28, 2026). Read it online. ↩
77. HHS, Healthcare and Public Health Sector Cybersecurity Performance Goals (10 essential and 10 enhanced goals, voluntary), released Jan. 2024 (read Oct. 28, 2026). Read it online. ↩
78. HHS, Freedom of Information Act page, content last reviewed Feb. 27, 2026 (read Oct. 28, 2026). Read it online. ↩
79. 5 U.S.C. 552(a)(6)(A), Freedom of Information Act response deadlines (read Oct. 28, 2026). Read it online. ↩
80. HHS OCR Breach Portal, "Breaches Affecting 500 or More Individuals," HIPAA list, Under Investigation tab (757 results shown Oct. 28, 2026; Shoshone Medical Center entry) (read Oct. 28, 2026). Read it online. ↩
81. Idaho Code 28-51-104 to 28-51-107 (definitions; notice, including 24-hour notice to the attorney general by public agencies; deemed compliance; civil actions and fines), Idaho Legislature (read Oct. 28, 2026). Read it online. ↩