Xsolis Data Breach Affects Almost 1.4 Million Patients
The healthcare AI platform provider Xsolis has announced a major data breach in which the protected health [...]
The HIPAA Guide - Celebrating Over 15 Years Online
HIPAA News Today: Breaches, Violations, and Fines
This section of The HIPAA Guide provides insights into HIPAA breaches, offering up-to-date reports on data violations within the healthcare sector. Readers can explore real-world case studies, breach penalties, and guidance on how healthcare organizations can improve data security. It also covers the consequences of non-compliance, breach notification requirements, and the latest cybersecurity threats affecting patient health information (PHI). Stay informed and learn how to prevent breaches to ensure both compliance and the protection of sensitive patient data.
Medtronic Data Breach: Notifications Issued to 3.8M Individuals
The medical device giant Medtronic has started issuing notification letters to individuals affected by an [...]
ShinyHunters Claims Responsibility for Amazon One Medical Seniors Data Breach
A massive data breach has been experienced by Amazon-owned One Medical Seniors Health, if the claims of the [...]
Employer-sponsored Health Plan Pays $450K HIPAA Penalty
An investigation of a ransomware attack on the U.S. retailer Spencer Gifts that exposed the electronic [...]
Flo Period & Ovulation Tracker App Users to Benefit from $59.5 Million Settlement
Users of the Flo Period & Ovulation Tracker App may claim their share of a $59.5 settlement fund as [...]
DentaQuest Data Breach: Data of 2.6 Million Individuals Leaked
The dental benefits administrator DentaQuest has recently disclosed a cybersecurity incident that is [...]
Conduent Business Services Confirms 2024 Data Breach Affected 62.2 Million Individuals
Conduent Business Services, a New Jersey-based provider of back-office services to healthcare organizations, [...]
OCR Reports to Congress on HIPAA Compliance and Data Breaches in 2024
One of the requirements of the Health Information Technology for Economic and Clinical Health (HITECH) Act of [...]
NYC Health + Hospitals Data Breach Affects Almost 2 Million Patients
The New York public health system, NYC Health + Hospitals, has started mailing notification letters to almost [...]
Healthcare Software Company Announces Data Breach Involving Congress Members PHI
The healthcare software provider RXNT has recently started notifying clients about a security incident that [...]
Democratic Senators Urge OPM to Cancel Plan to Collect Federal Workers’ Health Information
The Trump administration’s plan to collect health insurance claims data for all federal employees and [...]
Four Healthcare Orgs Fined for Risk Analysis Failures
Four investigations of ransomware attacks on HIPAA-regulated entities have resulted in financial penalties [...]
Major Healthcare Technology Firm Announces Data Breach
CareCloud, a major healthcare technology firm, has recently confirmed that hackers have breached parts of its [...]
Florida Suspends Third Party Administrator for Unlawful Offshoring of Medicare Enrollees’ Claims Data
An insurance regulator in Florida has suspended a third-party claims administrator for unlawfully [...]
Benefits Administrator Reports 2.7 Million-record Data Breach
Another massive data breach has been reported involving unauthorized access to the sensitive data of millions [...]
Business Associate Settles Alleged HIPAA Violations Following 15-Million-record Data Breach
The Department of Health and Human Services’ Office for Civil Rights (OCR) has announced another settlement [...]
QualDerm Partners Data Breach Affects 3.1 Million Patients
QualDerm Partners, a provider of healthcare management services to almost 160 dermatology practices, has [...]
More Than 3.4 Million Individuals Affected by TriZetto Provider Solutions Data Breach
A data breach at TriZetto Provider Solutions has affected more than 3.4 million individuals, according to a [...]
Two Ransomware Attacks on McLaren Health Care Result in $14M Settlement
McLaren Health Care, a Michigan-based non-profit health system, has agreed to settle a consolidated class [...]
Comstar Settles HIPAA Violations with State Attorneys General for $515,000
Massachusetts Attorney General Andrea Joy Campbell has announced a settlement has been agreed with the [...]
Covenant Health Cyberattack Affects More Than 478,000 Patients
Covenant Health has recently confirmed that almost half a million patients may have had some of their [...]
Aflac Data Breach: More Than 22.6 Million Individuals Affected
The scale of a June 2025 Aflac data breach has recently been confirmed – more than 22.6 million individuals [...]
New York Orthopedics Practice Pays $500K Penalty for Lax Cybersecurity
An orthopedic medical practice in New York state – Orthopedics NY LLC – has settled alleged [...]
Concentra Settles Alleged HIPAA Right of Access Violation for $112,500
The Department of Health and Human Services (HHS) Office for Civil Rights (OCR) has announced its 21st [...]
Kaiser Permanente to Pay up to $47.5 Million to Settle Website & App Tracking Lawsuit
A settlement has been agreed to resolve a class action lawsuit against Kaiser Permanente’s health insurance [...]
Physician Practices Pay $50 Million to Settle Data Breach Litigation
A network of nine affiliated physician practices has agreed to pay almost $50 million to settle class action [...]
Medical Imaging Provider Says More than 1.2 Million Individuals Affected by Cyberattack
A nationwide medical imaging provider has recently started notifying more than 1.2 million individuals that [...]
10-Year Insider Breach Identified by Texas Health System
Hackers are responsible for the majority of healthcare data breaches; however, healthcare providers must [...]
OCR Settles HIPAA Privacy & Breach Notification Rule Violations with Five Delaware Healthcare Facilities
The Department of Health and Human Services (HHS) Office for Civil Rights (OCR) has announced its 20th HIPAA [...]
Proposed Rule Requires Florida Healthcare Providers to Have a Continuity Plan
The Florida Agency for Health Care Administration (AHCA) has recently proposed a new rule (59A-35.112) that, [...]
Absolute Dental Notifies 1.2 Million Individuals About Data Breach
A Nevada dental care provider has recently announced a data breach that potentially involved unauthorized [...]
Cencora/The Lash Group Pay $40 Million to Resolve Data Breach Lawsuit
The Lash Group and Cencora have agreed to pay $40 million to resolve claims stemming from a 2024 data breach. [...]
Healthplex Agrees to Pay $2 Million to NYDFS to Resolve Cybersecurity Failures
A New York Department of Financial Services (DFS) investigation of a 2021 phishing attack on the dental [...]
DaVita Ransomware Attack Affects 2.7 Million Individuals
The HIPAA Guide previously reported that the ransomware attack on DaVita had affected more than 1 million [...]
Accountancy Firm Pays $175,000 Penalty for HIPAA Violation
The New York accountancy and management consultancy firm BST & Co. CPAs, LLP, has agreed to a $175,000 [...]
Change Healthcare Data Breach: 192.7 Million Affected
This article includes a timeline of the Change Healthcare ransomware attack as information was released and [...]
NY Surgery Center Pays Penalty for Risk Analysis and Breach Notification Failures
Syracuse ASC (Specialty Surgery Center of Central New York) has agreed to pay a $250,000 fine and adopt a [...]
Medical Imaging; Dermatology Practices Announce Data Breaches Impacting 3.3 Million Patients
Two massive data breaches have recently been announced by a dermatology practice and a medical imaging [...]
Biggest Healthcare Data Breaches in H1 2025
There has been a slight year-over-year decrease in healthcare data breaches and breached healthcare records. [...]
Victim Count of Nationwide Recovery Service Data Breach Grows to 516,000 Individuals
The victim count from a Nationwide Recovery Service data breach last year has been growing, with more [...]
Deer Oaks – The Behavioral Health Solution Pays $225,000 Fine to Resolve HIPAA Investigation
The HHS’ Office for Civil Rights has announced another settlement to resolve an alleged violation of the [...]
Episource Confirms 5.4 Million-Record Ransomware Data Breach
Episource has recently confirmed that the protected health information of more than 5.4 million individuals [...]
Comstar Ransomware Investigation Uncovers HIPAA Risk Analysis Failure
An investigation of a 2022 ransomware attack at Comstar uncovered a HIPAA risk analysis failure. Comstar [...]
ALN Medical Management Data Breach Affected 1.8 Million People
In March 2024, the Nebraska healthcare revenue cycle management and billing services provider ALN Medical [...]
BayCare Health System Settles Alleged HIPAA Violations for $800,000
BayCare Health System in Florida has settled three alleged violations of the HIPAA Rules with the HHS’ [...]
Kettering Health Cyberattack Causes System-wide Outage
Kettering Health, a faith-based health system in Ohio, has experienced a cyberattack that has caused a [...]
Vision Upright MRI Settles Alleged HIPAA Violations for $5,000
A small Californian medical imaging service provider has been discovered to be in violation of the HIPAA [...]
Healthcare Providers Sued Over Physical Therapist’s Unauthorized Access to Nude Patient Images
A class action lawsuit has been filed against the University of Kansas Health System, Lawrence Memorial [...]
Ascension Announces String of Business Associate Data Breaches
Ascension has announced that it has been affected by a data breach at one of its former business partners. [...]
Risk Analysis Failure Results in Financial Penalty for Comprehensive Neurology
The HHS’ Office for Civil Rights (OCR) has announced another settlement with a HIPAA-regulated entity under [...]
10.2 Million Individuals Affected by Two Healthcare Data Breaches
Two massive healthcare data breaches have recently been reported by HIPAA-regulated entities which combined [...]
HHS Settles Phishing Attack Investigation for $600,000
The HHS’ Office for Civil Rights (OCR) has settled an investigation of a phishing attack that saw 35 [...]
Guam Hospital Authority Pays $25K Penalty to Resolve HIPAA Risk Analysis Violation
The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) has resolved another [...]
Northeast Radiology Pays $350,000 Penalty for Alleged Risk Analysis Failure
Northeast Radiology, P.C., has agreed to settle an alleged violation of the risk analysis implementation [...]
Planned Parenthood Lab Test Vendor Reports 1.6 Million Record Data Breach
A lab test vendor used by Planned Parenthood centers across the country has reported a massive data breach [...]
Health Fitness Corporation Settles Alleged HIPAA Risk Analysis Violation for $228,000
The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) is continuing with its [...]
CareFirst BlueCross BlueShield of Maryland Sues Change Healthcare Over Ransomware Attack
A lawsuit has been filed by a Maryland health insurer against Change Healthcare over its February 2024 [...]
Oregon Health & Science University Fined $200,000 for HIPAA Right of Access Failure
Oregon Health & Science University has been fined $200,000 by the U.S. Department of Health and Human [...]
Warby Parker Fined $1,500,000 for HIPAA Noncompliance
The HHS Office for Civil Rights (OCR) has announced its first financial penalty for HIPAA noncompliance under [...]
What is the Proper Response to an Accidental HIPAA Violation?
The proper response to an accidental HIPAA violation depends on the nature of the violation, whether or not [...]
Risk Analysis Failure Results in $10,000 HIPAA Penalty
The HHS Office for Civil Rights (OCR) and Northeast Surgical Group, P.C. have agreed to a settlement to [...]
OCR Settles HIPAA Right of Access Case with Memorial Health System for $60,000
It has been a busy year of HIPAA enforcement by the HHS’ Office for Civil Rights (OCR). OCR Director [...]
OCR Settles HIPAA Phishing Violation Case for $3 Million
An OCR investigation of a phishing attack and subsequent mailing error by Solara Medical Supplies uncovered [...]
OCR Settles Alleged HIPAA Violations with USR Holdings for $337,750
The HHS’ Office for Civil Rights has announced a $337,750 settlement with the Florida business associate [...]
Data Hosting Provider Settles Alleged Risk Analysis HIPAA Violation for $90,000
A Virginia data hosting and cloud service provider that suffered a ransomware attack has agreed to settle an [...]
OCR Settles Ransomware Investigation and Agrees $80,000 Penalty for Risk Analysis Failure
The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) has announced another [...]
Dental Practice Fined 350K for Extensive HIPAA Violations and Ransomware Coverup
Westend Dental has agreed to a consent judgment and order that resolves multiple alleged violations of [...]
Ascension Ransomware Attack: 5.6 Million Patients Affected
It has taken more than 7 months for Ascension Health to determine how many individuals had their data stolen [...]
Healthcare Clearinghouse Pays $250K To Settle Alleged HIPAA Violations
Inmediata Health Group has agreed to pay $250,000 to settle alleged violations of the HIPAA Rules. The [...]
HealthAlliance Pays $550,000 Penalty for Cybersecurity Failure
The failure to mitigate a known vulnerability has landed the New York healthcare provider, HealthAlliance, [...]
Children’s Hospital Colorado Pays $548K Penalty for HIPAA Training; Risk Analysis Failures
Children’s Hospital Colorado has been fined $548,265 by the Department of Health and Human Services’ [...]
Florida Pain Management Practice Slapped with $1.19 Million HIPAA Fine
When members of the workforce leave employment, access to electronic protected health information (ePHI) must [...]
Pennsylvania Hospital Settles HIPAA Impermissible Disclosure Investigation with OCR
A Hospital in Pennsylvania has agreed to settle an alleged violation of the HIPAA Privacy Rule with the [...]
HHS-OIG: HIPAA Audit Program Not Effective at Preventing Breaches
The Department of Health and Human Services (HHS) Office for Civil Rights (OCR) HIPAA audit program is [...]
Mental Health Center Slapped With $100,000 HIPAA Right of Access Penalty
A Californian mental health center has been fined $100,000 for failing to provide a patient with timely [...]
Bryan County Ambulance Authority Pays $90,000 Penalty for Not Conducting a Risk Analysis
The Department of Health and Human Services (HHS) Office for Civil Rights (OCR) has announced its 1st [...]
OCR Imposes $70,000 CMP on Maryland Dental Practice for HIPAA Right of Access Violation
The HHS’ Office for Civil Rights (OCR) has imposed a $70,000 civil monetary penalty on a Maryland dental [...]
Providence Medical Institute Pays $240,000 CMP to Resolve Alleged HIPAA Violations
The HHS’ Office for Civil Rights (OCR) has announced its 8th financial penalty of the year to resolve [...]
OCR Settles Ransomware Attack Investigation with Washington Healthcare Provider
The Department of Health and Human Services (HHS) Office for Civil Rights (OCR) has announced a settlement [...]
CMS: 3.1 Million Individuals Affected by MOVEit Hack in 2023
The U.S. Centers for Medicare and Medicaid Services (CMS) has confirmed that more than 3.1 million [...]
$65 Million Settlement Agreed in Lehigh Valley Health Network Data Breach Lawsuit
A massive settlement has been agreed upon by counsels for the plaintiffs and defendants in a lawsuit against [...]
Ransomware Attack on Software Vendor Affects 954,177 Individuals
A massive data breach has been reported by an Atlanta-based software vendor that involved the health [...]
280,000 Individuals Affected by Alabama Cardiology Group Cyberattack
Alabama Cardiology Group (ACG) has notified the Department of Health and Human Services (HHS) Office for [...]
McLaren Health Care Suffers Second Major Cyberattack in a Year
Earlier this month, McLaren Health Care in Michigan announced it had fallen victim to a cyberattack that [...]
State AGs Secure $4.5 Million Settlement with Biochem Company to Resolve HIPAA Violations
Attorneys General in three U.S. states have agreed to a settlement with a biochemical company and its [...]
OCR Imposes 47th HIPAA Fine to Resolve a HIPAA Right of Access Violation
The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) has announced its 47th [...]
Data Breach Costs Increase by 10% to $4.9 Million
The average cost of a data breach has risen by 10% since 2023 to $4.88 million, the highest annual rise since [...]
Pharmacy Association and Providers Sue UnitedHealth to Recover Losses from Ransomware Attack
The National Community Pharmacists Association (NCPA) and around 40 healthcare providers are taking legal [...]
Change Healthcare Starts Mailing Individual Notification Letters About Ransomware Attack
Change Healthcare has published a substitute breach notice and has started mailing notification letters to [...]
Iowa ER Doctor Faces Up to 5 Years in Jail for HIPAA Violation
A Puerto Rican doctor has been convicted of wrongfully obtaining the individually identifiable health [...]
Pennsylvania Health System Hit with $950K Fine for Non-Compliance with the HIPAA Security Rule
A Pennsylvania health system has been fined $950,000 by the HHS’ Office for Civil Rights as part of a [...]
Former Nuance Communications Employee Accessed 1.2 Million Geisinger Records After Termination
A former employee of the Microsoft-owned HIPAA business associate, Nuance Communications, stole the protected [...]
Texas Surgeon Turned Whistleblower Faces HIPAA Violation Trial in Transgender Care Case
Federal prosecutors have charged surgeon Eithan Haim MD in a four-count indictment that alleges four [...]
California Attorney General and Adventist Health Agree to Settle HIPAA Lawsuit
The California Attorney General has agreed to a settlement with Adventist Health that resolves alleged [...]
Change Healthcare Confirms Types of Data Stolen in Ransomware Attack and Starts Issuing Notifications
Change Healthcare has confirmed the types of data compromised in its February ransomware attack and, four [...]
Blackbaud to Pay $6.75 Million Penalty to California Over 2020 Data Breach
Blackbaud, a South Carolina company that provides fundraising software for nonprofits has settled alleged [...]
OCR Clarifies Who is Responsible for Issuing Notifications About the Change Healthcare Cyberattack
The Department of Health and Human Services (HHS) Office of Civil Rights (OCR) has updated its Change [...]
Clarity Sought on HIPAA Breach Reporting Requirements for Change Healthcare Data Breach
The HHS’ Office for Civil Rights has published a FAQ on its website that includes guidance on the HIPAA [...]
Sav-Rx Reports Massive Data Breach Affecting 2.8 Million People
Sav-Rx, a pharmacy benefit management company, is notifying 2.8 million people that their personal and [...]
WebTPA Health Plan Administrator Announces 2.4 Million Record Data Breach
WebTPA Employer Services, a Texas-based provider of administrative services to health plans, has confirmed [...]
FTC Updates Health Breach Notification Rule to Cover Health Apps and Other Technologies
The Federal Trade Commission (FTC) has published a final rule that implements changes to its Health Breach [...]
Kaiser Foundation Health Plan Reports 13.4 Million-Record Data Breach
Kaiser Foundation Health Plan, Inc. has recently reported a major data breach to the HHS’ Office for Civil [...]
UnitedHealth Group Confirms Ransom Payment, Substantial Data Theft, and Predicts $1.6bn Loss
This week, UnitedHealth Group (UHG), the parent company of Change Healthcare, has confirmed that a ransom was [...]
Cerebral Fined $7 Million by FTC for Privacy and Security Violations
The Federal Trade Commission (FTC) has proposed a $7.1 million penalty for the mental healthcare platform [...]
RansomHub Group Threatens to Sell 4GB of Stolen Change Healthcare Data
On February 21, 2024, Change Healthcare suffered a ransomware attack that forced the company to take its [...]
FTC Prohibits Monument from Sharing Consumer Data for Advertising Purposes Without Consent
The Federal Trade Commission (FTC) has banned Monument from sharing consumer data with third-party [...]
OCR Imposes $100,000 Civil Monetary Penalty on New Jersey Nursing Facility for HIPAA Right of Access Violation
The HHS’ Office for Civil Rights has announced that Essex Residential Care, LLC has been ordered to pay a [...]
OCR Settles HIPAA Right of Access Investigation with Phoenix Healthcare
Another healthcare provider has paid a financial penalty after failing to comply with the HIPAA Right of [...]
OCR Investigates Change Healthcare Over Ransomware Attack
It has been three weeks since Change Healthcare experienced a Blackcat ransomware attack that caused massive [...]
5 Real HIPAA Violation Consequences
Many sources discussing HIPAA violation consequences tend to focus on civil monetary penalties and criminal [...]
Indiana Attorney General Alleges Apria Healthcare Violated HIPAA and State Laws
Apria Healthcare is alleged to have failed to comply with the HIPAA Privacy, Security, and Breach [...]
OCR Reports to Congress on HIPAA Compliance and Data Breaches
The Department of Health and Human Services recently submitted its annual reports to Congress on the state of [...]
Ransomware Attack Leads to Financial Penalty for Maryland Psychotherapy Center
The Department of Health and Human Services (HHS) Office for Civil Rights (OCR) has announced that a second [...]
Change Healthcare Cyberattack Affecting Pharmacies Nationwide
A Change Healthcare cyberattack has affected multiple systems at the Tennessee-based healthcare technology [...]
Small Healthcare Data Breaches Must be Reported by February 29, 2024
The deadline for reporting 2023 healthcare data breaches is fast approaching. Since 2024 is a leap year, the [...]
Integris Health Confirms 2.4 Million Record Data Breach
Integris Health, a not-for-profit health system that operates 16 hospitals and has healthcare providers in 49 [...]
OCR Settles HIPAA Security Rule Violations with Montefiore Medical Center for $4.75
The Department of Health and Human Services (HHS) Office for Civil Rights (OCR) has announced a $4.75 million [...]
6 Individuals Sentenced for Criminal HIPAA Violations
The U.S. Attorney’s Office for the Western District of Tennessee has announced that six individuals have [...]
FTC Orders Blackbaud to Address Reckless Data Security and Data Retention Practices
The Federal Trade Commission (FTC) has ordered Blackbaud to implement a raft of security measures after [...]
Optum Medical Care of New Jersey Settles HIPAA Right of Access Investigation for $160K
The Department of Health and Human Services (HHS) Office for Civil Rights (OCR) has announced a settlement [...]
Pharmacies are Disclosing Prescription Records to Law Enforcement Without a Warrant
Pharmacies have disclosed the prescription records of thousands of patients to law enforcement agencies [...]
2.5 Million Individuals Notified About Norton Healthcare Ransomware Attack
In May 2023, the Kentucky-based health system, Norton Healthcare, was attacked by the ALPHV/Blackcat [...]
Phishing Attack Leads to $480,000 HIPAA Penalty
The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) has settled its [...]
St. Joseph’s Medical Center Fined $80,000 For Allowing Reporter to Access Patients’ PHI
St. Joseph’s Medical Center in New York has chosen to settle allegations it violated the HIPAA Privacy Rule [...]
Data Breach at Transcription Service Provider Affects Almost 9 Million Patients
Perry Johnson & Associates (PJ&A), a provider of transcription services to healthcare providers, [...]
Data Security Failures at US Radiology Specialists Result in $450,000 Settlement
A $450,000 settlement has been agreed between New York Attorney General Letitia James and US Radiology [...]
Legal Challenge to OCR’s Guidance on Website Tracking Technologies
The Secretary of the Department of Health and Human Services (HHS) and the Director of the HHS’ Office for [...]
OCR Announces First Ever Ransomware-Related HIPAA Settlement
The Department of Health and Human Services’ Office for Civil Rights (OCR) has announced its first-ever [...]
Home Health Company Pays $350,000 to Resolve Alleged HIPAA Violations
Personal Touch Holding Corporation, a Long Island, NY-based home health company, has agreed to a settlement [...]
State Attorneys General Agree $1.4 Million Inmediata Settlement to Resolve HIPAA Violations
A coalition of 33 state attorneys general has reached a settlement with the Puerto Rico-based healthcare [...]
Blackbaud Settles HIPAA Violations with State AGs for $49.5 Million
The Charleston, SC-based fundraising service provider, Blackbaud, has agreed to a settlement with 49 states [...]
Indiana Settles Schneck Medical Center Data Breach Lawsuit for $250,000
The Indiana Attorney General has agreed to a $250,000 settlement with Schneck Medical Center. The settlement [...]
California and Kaiser Agree $49 Million Settlement to Resolve Improper Disposal Lawsuit
The California Attorney General and the district attorneys general from Alameda, San Bernardino, San [...]
Los Angeles Health Plan Fined $1,300,000 by OCR for Alleged HIPAA Violations
The HHS’ Office for Civil Rights (OCR) has announced a settlement has been reached with the nation’s [...]
OCR and FTC Publish Tracking Technology Warning Letters Sent to Hospitals and Telehealth Providers
In July 2023, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) and the [...]
UnitedHealthcare to Pay $80,000 to Settle Potential HIPAA Right of Access Violation
Last week, HHS’ Office for Civil Rights (OCR) announced the settlement of its latest HIPAA right of access [...]
Advocate Aurora Health Proposes $12.25 Million Settlement to Resolve Meta Pixel Lawsuit
Advocate Aurora Health has agreed to settle a consolidated class action lawsuit over its use of Meta Pixel [...]
HCA Healthcare Data Breach Impacts 11 Million Patients
HCA Healthcare, one of the largest health systems in the United States, has suffered a major data breach that [...]
$75,000 Settlement Agreed by iHealth Solutions to Resolve OCR HIPAA Case
The HHS’ Office for Civil Rights has agreed to settle a HIPAA case with the business associate iHealth [...]
Security Guards Snoop on Medical Records; Hospital Pays a $240,000 Penalty
The HHS’ Office for Civil Rights has announced its second HIPAA enforcement action of the month. Yakima [...]
OCR Fines New Jersey Psychiatry Practice for Google Review Responses
Manasa Health Center in New Jersey has agreed to pay $30,000 to resolve alleged HIPAA violations stemming [...]
Almost 9 Million Individuals Affected by Ransomware Attack on Dental Insurer
Managed Care of North America (MCNA) Dental has reported one of the largest ever breaches of protected health [...]
NY AG Slaps Medical Management Company with $550,000 HIPAA Penalty
New York Attorney General, Letitia James, has agreed to settle a compliance investigation with Professional [...]
PharMerica Cyberattack and Data Breach Affects 5.8 Million Patients
PharMerica, one of the largest pharmacy service providers in the United States, has recently confirmed that [...]
EyeMed Settles Multistate Data Brach Investigation for $2.5 Million
The Luxottica Group PIVA-owned vision benefits provider, EyeMed, has agreed to settle potential violations of [...]
MedEvolve Fined $350,000 for Storing PHI on an Unsecured Server
The Department of Health and Human Services’ Office for Civil Rights has announced a settlement has been [...]
OCR Announces 44th Fine Under its HIPAA Right of Access Initiative
The U.S. Department of Health and Human Services’ Office for Civil Rights (OCR) is continuing to crack down [...]
Virtually All Hospitals Used Website Tracking Code that Transmits Website Visitors’ Data to Third Parties
Tracking code has been used on virtually all hospital websites, according to a new study conducted by [...]
OCR: HIPAA Violation Complaints Increased in 2021 as Breaches Fell
The HHS’ Office for Civil Rights has sent annual reports to Congress on reported data breaches and its [...]
HHS Fines Banner Health $1.25M for HIPAA Security Rule Violations
The Department of Health and Human Services (HHS) Office for Civil Rights (OCR) has announced that the [...]
FTC Announces First Health Breach Notification Rule Enforcement Action
The Federal Trade Commission (FTC) has announced its first enforcement action over noncompliance with the [...]
Georgia Laboratory Fined €16,500 for Non-Compliance with HIPAA Right of Access
The HHS’ Office for Civil Rights (OCR) has announced that a diagnostic laboratory in Georgia – Life [...]
OCR Announces 42nd Financial Penalty for a HIPAA Right of Access Violation
The Right of Access provision of the HIPAA Privacy Rule permits patients to obtain a copy of their medical [...]
Dental Practice Fined $23,000 for Impermissible Disclosures of PHI on Yelp
HIPAA does not prohibit medical practices from responding to online reviews and feedback on platforms such as [...]
Aveanna Healthcare Resolves Alleged HIPAA Violations with $425,000 Settlement
Just a few weeks after settling a class action lawsuit over a 2019 data breach that affected 166,077 [...]
Advocate Aurora Health: PHI of up to 3 Million Patients Impermissibly Disclosed
Advocate Aurora Health says code snippets on its websites may have transmitted the protected health [...]
Cyberattack Causing Disruption at Second Largest Non-Profit U.S. Health System
A major cyberattack and IT outage are causing considerable disruption at one of the largest healthcare [...]
Dental Practices Pay Price for HIPAA Right of Access Noncompliance
The HIPAA Right of Access provides individuals with the right to obtain a copy of the medical records held by [...]
Improper PHI Disposal Leads to $300,000 HIPAA Penalty for Massachusetts Dermatology Practice
The HHS’ Office for Civil Rights (OCR) has announced its 17th financial penalty of the year to resolve [...]
Meta Pixel Code on Novant Health Website Disclosed Data of 1.3 Million Patients to Meta
Novant Health has notified more than 1.3 million patients that some of their protected health information has [...]
Oklahoma State University Settles HIPAA Investigation and Pays $875,000 Penalty
An investigation conducted by the HHS’ Office for Civil Rights (OCR) of a hacking incident at Oklahoma [...]
Massive Data Breach at Business Associate Affects 657 Healthcare Provider Clients
Cyberattacks on business associates of HIPAA-covered entities have the potential to affect many covered [...]
Patient Data Sent to Meta Without Consent by Hospitals via Meta Pixel Tool on Websites
An investigation into the use of the Meta Pixel tool on hospital websites has revealed one-third of the top [...]
2 Million-record Data Breach Reported by Massachusetts Medical Imaging Services Provider
A data breach affecting 2 million individuals has been reported to the Department of Health and Human [...]
Ransomware Attacks Increased by 13% in 2021
Ransomware attacks are increasing at an alarming rate. Attacks increased by 13% in 2021, which is a bigger [...]
Hacking Incident at Cloud EHR Vendor Impacts Multiple Eye Care Practices
Eye Care Leaders, a vendor of cloud-based electronic health record and practice management solutions for eye [...]
Financial Penalties Imposed for HIPAA Right of Access Violations and Impermissible PHI Disclosures
The U.S. Department of Health and Human Services’ Office for Civil Rights recently announced that four [...]
Texas Dental Clinic Operator Announces Breach Affecting 1 Million Texans
A major data breach has recently been reported by a dental clinic operator in Texas that has affected more [...]
Monongalia Health Data Breach Affects Almost 500,000 Patients
Monongalia Health System in West Virginia (Mon Health) has recently announced it fell victim to a cyberattack [...]
Settlements Proposed to Resolve Class Action Lawsuits Against Inmediata and CaptureRx
Settlements have been proposed to resolve class action lawsuits filed against the healthcare clearinghouse [...]
RIPTA and UnitedHealthcare Investigated Over Breach of 22,000 State Employee Records
On December 21, 2021, the Rhode Island Public Transport Authority (RIPTA), a quasi-public agency, reported a [...]
Over 1.3 Million Individuals Affected by Cyberattack and Data Theft Incident at Broward Health
On January 1, 2021, Broward Health announced it was the victim of a cyberattack involving data exfiltration [...]
New Jersey Companies Settle State HIPAA Investigation and Pay $425,000 Penalty
The New Jersey Attorney General has been the most active enforcer of compliance with the Health Insurance [...]
Half a Million Records Potentially Stolen in 2 Healthcare Ransomware Attacks
The healthcare industry in the United States continues to be targeted by ransomware gangs. Recently, the [...]
EHR Vendor Reports Breach of PHI of Nearly 320,000 Patients
The protected health information of almost 320,000 patients has potentially been compromised in an August [...]
$495,000 HIPAA Settlement Reached Between New Jersey and Fertility Clinic
An investigation by the state of New Jersey into a cyberattack on a fertility clinic has uncovered multiple [...]
Ransomware Attack on Massachusetts Fertility Testing Laboratory Affects 350,000 Patients
The Marlborough, MA-based fertility-related medical laboratory ReproSource Fertility Diagnostics has started [...]
Lawsuit: Baby Died as a Consequence of Hospital Ransomware Attack
A lawsuit has been filed on behalf of a mother of a baby who is alleged to have died as a consequence of a [...]
OCR Imposes $80,000 Fine on Nebraska Hospital for HIPAA Right of Action Violation
Children’s Hospital & Medical Center (CHMC) has agreed to settle a HIPAA Right of Access [...]
Scripps Health Ransomware Attack Cost Increases to $112.7 Million
The 2021 IBM Security/Ponemon Institute Cost of a Data Breach Study determined the average cost of a data [...]
PHI of 447,000 Patients Potentially Compromised in Phishing Attack
Ransomware gangs have increased attacks on the healthcare industry. Data from Emsisoft show 560 healthcare [...]
Average Healthcare Data Breach Cost Increases to $9.23 Million
According to the 2021 IBM Security Cost of a Data Breach report, the average cost of a data breach has risen [...]
Data Breach Affects up to 2.4 Million Forefront Dermatology Patients
A major data breach has occurred at Wisconsin-based Forefront Dermatology. The protected health information [...]
California has Updated its Medical Data Breach Notification Regulations and Administrative Penalties
California has updated its data breach reporting requirements for healthcare facilities and has also [...]
Ohio Care Coordinator Accessed Patient Records Without Authorization for Almost 12 Years
Accessing the medical records of patients when there is no legitimate work reason for doing is a violation of [...]
Ransomware Attack on Eye Clinic Network Affects Half a Million Patients
On February 8, 2021, Wolfe Eye Clinic in Iowa suffered a ransomware attack that resulted in widespread [...]
PHI of 3,253,822 Individuals Potentially Stolen and Deleted from 20/20 Hearing Care Network’s AWS Environment
The protected health information (PHI) of 3,253,822 current and former members of the 20/20 Hearing Care [...]
OCR Announces 19th HIPAA Right of Access Settlement
The U.S. Department of Health and Human Services’ Office for Civil Rights has fined an endocrine disorder [...]
Multiple HIPAA Security Rule Failures Result in $25,000 HIPAA Fine for Clinical Laboratory
The U.S. Department of Health and Human Services’ Office for Civil Rights (OCR) has announced its 7th HIPAA [...]
UHS Data Breach Lawsuit Proceeds for Plaintiff Whose Surgery was Delayed
It is now common for the victims of healthcare data breaches to take legal action against a healthcare [...]
Montefiore Staff Member Fired for HIPAA Breach; Belden Facing Class Action Suit
Another staff member at New York’s Montefiore Medical Center has been found to have been illegally [...]
PHI of Almost 3.5 Million Individuals was Compromised in the Accellion Cyberattack
The number of healthcare organizations known to have been affected by the Accellion cyberattack has been [...]
OCR Announces 18th Settlement Under HIPAA Right of Access Enforcement Initiative
The U.S. Department of Health and Human Services’ Office for Civil Rights has announced its 18th settlement [...]
Massachusetts Hospital Pays $65,000 Penalty to Settle HIPAA Right of Access Case
The HHS’ Office for Civil Rights has fined Arbour Hospital $65,000 for failing to provide a patient with [...]
Medical Debt Collection Firm Settles Data Breach Case with Coalition of 41 State AGs
In 2019, the largest reported healthcare data breach was at American Medical Collection Agency (AMCA), a debt [...]
Georgia Man Jailed for Attempting to Frame Nurse for Fake HIPAA Violations
This month, a U.S District Court judge for the Southern District of Georgia has sentenced a man for making [...]
OCR Announces $70,000 Settlement with Sharpe Healthcare to Resolve HIPAA Right of Access Case
Sharpe Healthcare has agreed to settle a HIPAA violation case with the Department of Health and Human [...]
Florida Health Insurer Discovers Breach of the PHI of 3.5 Million Individuals
One of the largest ever healthcare data breaches has recently been reported by the Florida-based health [...]
OCR Announces Fifteenth Settlement Under its HIPAA Right of Access Enforcement Initiative
The HHS’ Office for Civil Rights (OCR) has agreed to settle a HIPAA Right of Access enforcement action [...]
FTC Finalizes Settlement with SkyMed International to Resolve Allegations of Security and Data Breach Response Failures
The Federal Trade Commission (FTC) has announced the settlement with SkyMed International has been finalized [...]
$4.3 Million HIPAA Penalty for MD Anderson Cancer Center Vacated by Court of Appeals
The 5th Circuit U.S. Court of Appeals in Louisiana has vacated the civil monetary penalties imposed on the [...]
Excellus Health Plan Hit with $5.1 Million Penalty for 10 Million-Record Data Breach
Excellus Health Plan has settled a HIPAA violation case with the HHS’ Office for Civil Rights and has [...]
HHS Announces Largest Ever Financial Penalty for HIPAA Right of Access Failure
The U.S. Department of Health and Human Services has issued its largest ever HIPAA fine for noncompliance [...]
OCR Announces 13th HIPAA Right of Access Settlement
In 2019, the Department of Health and Human Services’ Office for Civil Rights announced a new HIPAA [...]
Dental Care Alliance Cyberattack Impacts More Than 1 Million Patients
The protected health information of more than a million dental patients has potentially been obtained by [...]
OCR Fines University of Cincinnati Medical Center $65,000 for Failure to Provide Patient’s Medical Records
The University of Cincinnati Medical Center (UCMC) has been fined $65,000 by the HHS’ Office for Civil [...]
OCR Announces 11th Financial Penalty under HIPAA Right of Access Enforcement Initiative
A Regal Park, NY-based private otolaryngology practitioner has been issued with a $15,000 financial penalty [...]
10th Financial Penalty Announced Under OCR’s HIPAA Right of Access Enforcement Initiative
The HHS’ Office for Civil Rights has made good on its promise to step up enforcement of compliance with the [...]
ShopRite Data Breach Results in $235,000 HIPAA Penalty for Wakefern Food Corporation
New Jersey Attorney General General Gurbir S. Grewal and the New Jersey Division of Consumer Affairs have [...]
Aetna Pays $1,000,000 Penalty to Resolve Multiple Violations of the HIPAA Rules
The health plan Aetna, part of the Aetna Life Insurance Company, has agreed to pay a $1 million penalty to [...]
$100,000 Financial Penalty Imposed on NY Spine for HIPAA Right of Access Failure
In 2019, the U.S. Department of Health and Human Services’ Office for Civil Rights launched its HIPAA Right [...]
Community Health Systems Settles Data Breach Case with 28 State Attorneys General for $5 Million
Tennessee Attorney General Herbert H. Slatery III has announced a $5 million settlement has been reached with [...]
OCR Issues 8th HIPAA Penalty Under HIPAA Right of Access Enforcement Initiative
The Department of Health and Human Services’ Office for Civil Rights has imposed its 8th HIPAA penalty on a [...]
Anthem Settles Multi-State Action with State Attorneys General Over 2014 Data Breach
A multi-state investigation by attorneys general in 42 states and Washington D.C. over the 78.8 million [...]
Premera Blue Cross to Pay $6.8 Million OCR HIPAA Fine for 2014 Data Breach
The HHS’ Office for Civil Rights (OCR) has imposed its second largest ever HIPAA violation penalty – [...]
$2.3 Million HIPAA Penalty for Business Associate for 6 Million-Record Data Breach
The Community Health Systems business associate, CHSPSC LLC, has settled its HIPAA violation case with the [...]
Athens Orthopedic Clinic Agrees to Pay $1.5 Million to Settle OCR HIPAA Violation Case
The Department of Health and Human Services’ Office for Civil Rights (OCR) has settled another HIPAA [...]
OCR Settles 5 More HIPAA Right of Access Cases
In 2019, the HHS’ Office for Civil Rights launched an enforcement initiative targeting organizations that [...]
Medical Data Being Exposed via Public GitHub Repositories
Research recently published in a collaborative report by security researcher Jelle Ursem and DataBreaches has [...]
$25,000 Penalty for Small Healthcare Provider for HIPAA Security Rule Failures
The Department of Health and Human Services’ Office for Civil Rights (OCR) has agreed to settle a HIPAA [...]
914,000 Patients Impacted by Hacking of Florida Orthopedic Institute and Benefit Recovery Specialists
The protected health information of 914,000 patients has potentially been compromised in two hacking [...]
At Least 365K Patients Impacted by Magellan Health Ransomware Attack
In April 2020, the Fortune 500 firm Magellan Health experienced a ransomware attack that resulted in [...]
Episcopal Health Services Data Breach Lawsuit Sent Back to State Court for Further Proceedings
A lawsuit filed against Episcopal Health Services following a phishing attack that exposed the protected [...]
PHI of 170,000 Patients Potentially Compromised in Recent Phishing Attacks
Monthly breach reports show that email is the most common location of breached protected health information. [...]
$100,000 HIPAA Fine Imposed on Physician Practice for Security Rule Violations
A $100,000 HIPAA fine has been imposed on a solo physician practice for HIPAA Security Rule failures [...]
Analysis of 2019 Healthcare Data Breaches
A recent analysis of 2019 healthcare data breaches by Protenus has confirmed that 2019 was a particularly bad [...]
Widespread E1 Transactions Violations Discovered by HHS’ Office of Inspector General
A recent audit of a mail-order pharmacy and 29 other healthcare provides by the Department of Health and [...]
HIPAA Compliance Failures Result in $65,000 Fine for Georgia Ambulance Company
West Georgia Ambulance, Inc., an ambulance company serving Carroll County in Georgia, has agreed to settle a [...]
OCR Issues Second Fine for Noncompliance with HIPAA Right of Access
The Department of Health and Human Services’ Office for Civil Rights has announced another settlement has [...]
Breach Notification Rule Failure Leads to $2.175 Million HIPAA Settlement
A breach notification failure and the lack of a business associate agreement has led to a $2.175 million [...]
OCR Imposes $1.6 Million Civil Monetary Penalty on Texas Health and Human Services Commission for HIPAA Violations
The Department of Health and Human Services’ Office for Civil Rights (OCR) has fined another HIPAA-covered [...]
9 Unsecured Medical Databases Found Containing Millions of Patient Records
Security researchers at Wizecase have discovered 9 medical databases containing millions of patient records [...]
Jackson Health System Pays $2.15 Million Penalty for Widespread Noncompliance with HIPAA Rules
Jackson Health System (JHS) has paid a $2.15 million civil monetary penalty to the HHS’ Office for Civil [...]
Dental Practice Gets $10,000 HIPAA Penalty for PHI Disclosures on Social Media
A dental practice has been fined $10,000 by the HHS’ Office for Civil Rights for violating Health Insurance [...]
HIPAA Right of Access Failure Attracts $85,000 Financial Penalty
The HHS’ Office for Civil Rights has announced the first HIPAA settlement under its HIPAA Right of Access [...]
400 Million Medical Images Found to Be Freely Accessible Over the Internet
A recent investigation by ProPublica, Greenbone Networks, and the German public broadcaster Bayerischer [...]
Summary of July 2019 Healthcare Data Breaches
It has been another terrible month for healthcare data breaches – The worst of the year to date in terms of [...]
51% of Healthcare Providers Are Not Fully Compliant with HIPAA Right of Access
Healthcare providers are providing patients with copies of their medical records, but a majority have been [...]
$74 Million Premera Blue Cross Settlement Gets Preliminary Approval
A consolidated class action lawsuit against Premera Blue Cross over its 2014 data breach of 10.6 million [...]
$145 Settlement Proposed by Allscripts to Resolve HIPAA and Anti-Kickback Case
Allscripts Healthcare Solutions has proposed a settlement of $145 million to resolve alleged violations of [...]
AMCA Breach Victim Count Nears 24 Million
Over the past 10 days, several more healthcare providers have announced that they have been affected by the [...]
Premera Blue Cross Settles HIPAA Case for $10 Million
Premera Blue Cross has agreed to settle its HIPAA violation lawsuit and pay a $10 million penalty to resolve [...]
Unauthorized Medical Record Access and Disclosure Results in 1 Year Jail Term
The penalties for HIPAA violations are usually restricted to fines for the covered entity or business [...]
Almost 2 Million Records Exposed in May 2019 Healthcare Data Breaches
It has been another bad month for the U.S. healthcare industry. Rather than April’s record number of [...]
AMCA Files for Bankruptcy Following Massive Data Breach
After 42 years in business, the parent company of American Medical Collections Agency (AMCA) has sought [...]
More Than 20 Million Individuals Impacted by AMCA Data Breach
The number of individuals affected by the data breach at American Medical Collections Agency (AMCA) continues [...]
PHI of 11.9 Million Quest Diagnostics Patients Compromised in AMCA Data Breach
Quest Diagnostics, one of the largest medical laboratory chains in the United States, has announced that [...]
EHR Provider to Pay $900,000 to Resolve Multi-State HIPAA Case
Just a few days after the HHS’ Office for Civil Rights announced a settlement had been reached with Medical [...]
HHS Confirms When Business Associates Can be Held Directly Liable for HIPAA Violations
The Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009, and the subsequent [...]
Medical Informatics Engineering Issued with $100,000 HIPAA Violation Penalty
The Department of Health and Human Services’ Office for Civil Rights has announced a settlement has been [...]
The HIPAA Guide is a registered trademark. Copyright © 2007-2026 The HIPAA Guide. All rights reserved.
