INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

HIPAA Violation Cases: Types & Consequences

| 2026-10-30 22:17 CRITICAL LOW DATA BREACH
JSON
Executive Summary
AI-generated
Violation Cases: Types & Consequences HIPAA violation cases are compliance investigations that result from a data breach being reported to the Department of Health and Human Services’ (HHS) Office for Civil Rights (OCR) or a privacy complaint being submitted to OCR via the complaints portal. When OCR identifies a violation of HIPAA, violation cases can be resolved in multiple ways. OCR may choose to take no action if the HIPAA-regulated entity has identified and voluntarily corrected the HIPAA violation.
Technical Mitigations AI-generated
• Implement a risk analysis to identify and mitigate potential HIPAA violations. • Develop a contingency plan to ensure business continuity in the event of a data breach or other security incident.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
NORTH_AMERICA NORTH_AMERICA financefinance legallegal retailretail healthhealth educationeducation governmentgovernment
Incident Timeline
‎March 7, 2010
Between October 23, 2009, and March 7, 2010, part of its database of policyholders was accessible to unauthorized individuals.
industry Finance
General Document Context
industry Health
General Document Context
industry Government
General Document Context
industry Education
General Document Context
industry Retail
General Document Context
industry Legal
General Document Context
financial $400,000
A settlement of $400,000 was agreed upon with OCR to resolve the HIPAA violations .
organisation HHS’ Office for Civil Rights
The number of alleged HIPAA violation cases received each year by HHS’ Office for Civil Rights varies.
organisation Covered Entities
Complaints can also be made to individual Covered Entities and State Attorneys General, but there is no public record of these.
organisation State Attorneys General
Complaints can also be made to individual Covered Entities and State Attorneys General, but there is no public record of these.
organisation Archive
For details of recent HIPAA violation cases that have not resulted in a civil monetary penalty, visit the HHS’ Breach Portal and click on the link to the Archive.
organisation the Covered Entity
Cases of HIPAA violations are investigated most often by the Covered Entity to whom they are reported.
organisation HHS’ Office for Civil Rights or
Indeed, many Covered Entities don´t provide the contact details for HHS’ Office for Civil Rights on their  Notices of Privacy Practices , so most complaints about HIPAA violations are reported directly to them rather than the HHS’ Office for Civil Rights or State Attorneys General.
organisation HIPAA requires Business Associates
Cases of HIPAA violations can also be reported internally by members of a Covered Entity’s workforce, and HIPAA requires Business Associates to report all security incidents to the Covered Entity – including those that do not constitute a HIPAA violation – so again, the Covered Entity gets to hear about violations first before deciding whether the events are notifiable.
organisation Covered Entity
Cases of HIPAA violations can also be reported internally by members of a Covered Entity’s workforce, and HIPAA requires Business Associates to report all security incidents to the Covered Entity – including those that do not constitute a HIPAA violation – so again, the Covered Entity gets to hear about violations first before deciding whether the events are notifiable.
organisation the Privacy, Security
HIPAA violations that are not violations of the Privacy, Security, and Breach Notification Rules are investigated by other federal agencies.
organisation Breach Notification Rules
HIPAA violations that are not violations of the Privacy, Security, and Breach Notification Rules are investigated by other federal agencies.
organisation Medicare
For example, the Centers for Medicare and Medicaid Services investigates cases of Part 162 HIPAA violations, the Department of Labor investigates violations of HIPAA’s portability provisions, and the Federal Trade Commission investigates violations of the Breach Notification Rule by companies that are not Covered Entities or Business Associates.
organisation Medicaid Services
For example, the Centers for Medicare and Medicaid Services investigates cases of Part 162 HIPAA violations, the Department of Labor investigates violations of HIPAA’s portability provisions, and the Federal Trade Commission investigates violations of the Breach Notification Rule by companies that are not Covered Entities or Business Associates.
organisation the Department of Labor
For example, the Centers for Medicare and Medicaid Services investigates cases of Part 162 HIPAA violations, the Department of Labor investigates violations of HIPAA’s portability provisions, and the Federal Trade Commission investigates violations of the Breach Notification Rule by companies that are not Covered Entities or Business Associates.
organisation the Federal Trade Commission
For example, the Centers for Medicare and Medicaid Services investigates cases of Part 162 HIPAA violations, the Department of Labor investigates violations of HIPAA’s portability provisions, and the Federal Trade Commission investigates violations of the Breach Notification Rule by companies that are not Covered Entities or Business Associates.
organisation Covered Entities or
For example, the Centers for Medicare and Medicaid Services investigates cases of Part 162 HIPAA violations, the Department of Labor investigates violations of HIPAA’s portability provisions, and the Federal Trade Commission investigates violations of the Breach Notification Rule by companies that are not Covered Entities or Business Associates.
organisation Right of Access
Why have patients’ rights violation cases been prioritized? Patients’ rights violation cases appear to have been prioritized in recent years because in 2019, HHS’ Office for Civil Rights announced a Right of Access enforcement initiative.
organisation the Privacy Rule
A breach of patient confidentiality is not necessarily a HIPAA violation because some disclosures of PHI permitted by the Privacy Rule may be considered a breach of patient confidentiality by the patient, even though they are not.
financial $1,700,000
A settlement of $1,700,000 has been agreed upon with OCR to resolve the HIPAA violations that contributed to the cause of the breach.
financial $115 million
More than 100 private class action lawsuits were filed against Anthem, the ultimately consolidated case being settled for $115 million.
‎September 29, 2011
General Document Context On September 29, 2011, a portable USB storage device (pen drive) was left overnight in the IT Department, from where it was stolen.
industry Finance
General Document Context
industry Health
General Document Context
industry Government
General Document Context
industry Education
General Document Context
industry Retail
General Document Context
industry Legal
General Document Context
organisation the IT Department
On September 29, 2011, a portable USB storage device (pen drive) was left overnight in the IT Department, from where it was stolen.
financial $400,000
CNE is required to pay a financial penalty of $400,000 and must adopt a comprehensive Corrective Action Plan (CAP) to address various areas of HIPAA non-compliance.
organisation CNE
CNE is required to pay a financial penalty of $400,000 and must adopt a comprehensive Corrective Action Plan (CAP) to address various areas of HIPAA non-compliance.
organisation MAPFRE
MAPFRE has agreed to a $2,200,000 settlement with OCR.
financial $2,200,000
MAPFRE has agreed to a $2,200,000 settlement with OCR.
organisation Presence Health
Presence Health took three months to issue breach notifications when the Breach Notification Rule requires notifications to be sent within 60 days of the discovery of a breach.
organisation St. Joseph Health
St. Joseph Health has agreed to pay OCR $2,140,500.
financial $2,140,500
St. Joseph Health has agreed to pay OCR $2,140,500.
financial $5.55 million
Advocate Health Care Network will pay a record $5.55 million to settle multiple potential violations of the Health Insurance Portability and Accountability Act.
‎October 2011
Cancer Care Group, P.C. agreed to pay $750,000 for potential HIPAA violations relating to a 2012 data breach without admission of liability.
organisation Lahey Hospital
Lahey Hospital and Medical Center agreed to pay $850,000 to settle the case without admission of liability.
organisation Medical Center
Lahey Hospital and Medical Center agreed to pay $850,000 to settle the case without admission of liability.
financial $850,000
Lahey Hospital and Medical Center agreed to pay $850,000 to settle the case without admission of liability.
‎August 2012
In August 2012, Cancer Care Group discovered a laptop computer and an unencrypted backup drive had been stolen from the vehicle of an employee.
financial $150,000
ACMHS has agreed to settle the case with OCR for $150,000.
A settlement of $150,000 has been reached with OCR.
organisation Cancer Care Group
In August 2012, Cancer Care Group discovered a laptop computer and an unencrypted backup drive had been stolen from the vehicle of an employee.
organisation Cornell Pharmacy
Cornell Pharmacy is a single-location healthcare provider that mostly serves hospice care organizations in Denver and provides compound medications.
organisation Presbyterian Hospital
New York and Presbyterian Hospital (NYP) and Columbia University (CU) will jointly pay a penalty of $4,800,000.
financial $4,800,000
New York and Presbyterian Hospital (NYP) and Columbia University (CU) will jointly pay a penalty of $4,800,000.
organisation the Protected Health Information
The data breach exposed the Protected Health Information of 55,000 patients.
organisation SEMC
The settlement for HIPAA violations was reached with SEMC for violations that led to a document sharing system data breach that exposed 498 records, and a data breach involving the theft of a flash drive containing unencrypted data of 595 patients.
data_breach 498 records
The settlement for HIPAA violations was reached with SEMC for violations that led to a document sharing system data breach that exposed 498 records, and a data breach involving the theft of a flash drive containing unencrypted data of 595 patients.
organisation Columbia University
The data breach was caused when a computer server firewall was deactivated by a physician at Columbia University, leaving electronic PHI exposed and accessible via search engines.
financial $250,000
QCA Health Plan has agreed to settle the HIPAA violations with OCR for $250,000.
organisation ACMHS
ACMHS has agreed to settle the case with OCR for $150,000.
organisation Parkview Healthcare System
Parkview Health System, Inc. – Failure to Safeguard PHI Parkview Healthcare System has agreed to pay an $800,000 settlement for a violation of the HIPAA Privacy Rule.
financial $800,000
Parkview Health System, Inc. – Failure to Safeguard PHI Parkview Healthcare System has agreed to pay an $800,000 settlement for a violation of the HIPAA Privacy Rule.
data_breach 8,000 patient records
The doctor was retiring and received a delivery of 71 boxes of medical files containing up to 8,000 patient records; however, the delivery was made, and the boxes were left on the doctor’s driveway while he was out of the house.
financial $1,725,220
Concentra has agreed to pay OCR $1,725,220 to resolve the case.
financial $215,000
Skagit County agreed to pay OCR $215,000 following the exposure of the data of seven individuals.
‎September 23, 2013
Raleigh Orthopaedic failed to enter into a business associate agreement with a vendor before handing over the protected health information of 17,300 patients in 2013.
industry Finance
General Document Context
industry Health
General Document Context
industry Government
General Document Context
industry Education
General Document Context
industry Retail
General Document Context
industry Legal
General Document Context
financial $750,000
Raleigh Orthopaedic has agreed to pay OCR $750,000 for failing to enter into a business associate agreement (BAA) with a vendor before handing over the protected health information (PHI) of 17,300 patients in 2013.
organisation Raleigh Orthopaedic
Raleigh Orthopaedic has agreed to pay OCR $750,000 for failing to enter into a business associate agreement (BAA) with a vendor before handing over the protected health information (PHI) of 17,300 patients in 2013.
organisation NYP
An ABC crew was permitted to film inside NYP facilities for the show “NY Med” featuring Dr. Mehmet Oz.
organisation NY Med
An ABC crew was permitted to film inside NYP facilities for the show “NY Med” featuring Dr. Mehmet Oz.
financial $239,800
Lincare Inc. is required to pay $239,800 for violations of the HIPAA Privacy Rule, which were discovered during the investigation of a complaint about a breach of 278 patient records.
data_breach 278 patient records
Lincare Inc. is required to pay $239,800 for violations of the HIPAA Privacy Rule, which were discovered during the investigation of a complaint about a breach of 278 patient records.
financial $1,550,000
North Memorial has agreed to pay $1,550,000 to OCR to settle the HIPAA violation charges.
‎April 1, 2014
Anthem Inc. agreed to a record-breaking settlement of $16,000,000 to resolve the case involving multiple HIPAA violations and an impermissible disclosure of 78.8 million patient records.
financial $100,000
Boston Medical Center agreed to settle the alleged HIPAA violations with OCR for $100,000.
FileFax agreed to settle the alleged HIPAA violations for $100,000.
industry Finance
General Document Context
industry Health
General Document Context
industry Government
General Document Context
industry Education
General Document Context
industry Retail
General Document Context
industry Legal
General Document Context
organisation Allergy Associates
Allergy Associates of Hartford paid OCR $125,000 to settle the alleged HIPAA violations.
financial $125,000
Allergy Associates of Hartford paid OCR $125,000 to settle the alleged HIPAA violations.
organisation Fresenius Medical Care North America
Fresenius Medical Care North America settled the case for $3,500,000.
financial $3,500,000
Fresenius Medical Care North America settled the case for $3,500,000.
organisation Boston Medical Center
Boston Medical Center agreed to settle the alleged HIPAA violations with OCR for $100,000.
organisation FileFax
FileFax agreed to settle the alleged HIPAA violations for $100,000.
organisation Women’s Hospital
Brigham and Women’s Hospital agreed to settle the alleged HIPAA violations with OCR for $384,000.
financial $384,000
Brigham and Women’s Hospital agreed to settle the alleged HIPAA violations with OCR for $384,000.
organisation Massachusetts General Hospital
Massachusetts General Hospital agreed to settle the alleged HIPAA violations with OCR for $515,000.
financial $515,000
Massachusetts General Hospital agreed to settle the alleged HIPAA violations with OCR for $515,000.
organisation University of Texas
University of Texas MD Anderson Cancer Center was ordered to pay a civil monetary penalty of $4,348,000.
financial $4,348,000
University of Texas MD Anderson Cancer Center was ordered to pay a civil monetary penalty of $4,348,000.
financial $500,000
A settlement of $500,000 was agreed upon to resolve the alleged HIPAA violations.
financial $16,000,000
Anthem agreed to a record-breaking settlement of $16,000,000 to resolve the case.
data_breach 2,150 patient records
OCR determined there had been a failure to protect patient information, which resulted in an impermissible disclosure of 2,150 patient records.
‎September 2015
Memorial Hermann Health System agreed to pay OCR $2,400,000 and adopt a robust corrective action plan after an impermissible disclosure in a press release issued by MHHS in September 2015.
organisation CardioNet
CardioNet is a Pennsylvania-based provider of remote mobile monitoring and rapid response services to patients at risk for cardiac arrhythmias.
organisation Memorial Hermann Health System
Memorial Hermann Health System has agreed to pay OCR $2,400,000.
financial $2,400,000
Memorial Hermann Health System has agreed to pay OCR $2,400,000.
organisation The Center for Children’s Digestive Health
The Center for Children’s Digestive Health (CCDH); a small 7-center pediatric subspecialty practice based in Park Ridge, Illinois, has agreed to pay OCR $31,000 to resolve potential HIPAA violations.
financial $31,000
The Center for Children’s Digestive Health (CCDH); a small 7-center pediatric subspecialty practice based in Park Ridge, Illinois, has agreed to pay OCR $31,000 to resolve potential HIPAA violations.
organisation Metro Community Provider Network
Metro Community Provider Network (MCPN) has agreed to pay OCR $400,000 and adopt a robust corrective action plan to resolve all HIPAA compliance issues identified during the OCR investigation.
financial $400,000
Metro Community Provider Network (MCPN) has agreed to pay OCR $400,000 and adopt a robust corrective action plan to resolve all HIPAA compliance issues identified during the OCR investigation.
organisation Memorial Healthcare Systems
Memorial Healthcare Systems has paid the penalty for non-compliance with HIPAA Rules, and in addition to the $5.5 million settlement, a robust corrective action plan must be adopted to address all areas of non-compliance.
financial $5.5 million
Memorial Healthcare Systems has paid the penalty for non-compliance with HIPAA Rules, and in addition to the $5.5 million settlement, a robust corrective action plan must be adopted to address all areas of non-compliance.
financial $387,200
St. Luke’s-Roosevelt Hospital Center Inc. has paid OCR $387,200 to resolve potential HIPAA violations discovered during an OCR investigation of a complaint about an impermissible disclosure of PHI.
‎November 2015
OHSU agreed to pay a $2.7 million penalty without admission of liability for alleged HIPAA violations, settling the case within three months after an incident exposed protected health information of over 7,000 patients.
financial $3,500,000
The previous record was the $3.5 million settlement with Triple S Management Corporation, agreed in November 2015.
organisation Triple S Management Corporation
The previous record was the $3.5 million settlement with Triple S Management Corporation, agreed in November 2015.
organisation UMMC
UMMC has also agreed to adopt a corrective action plan (CAP) to bring privacy and security standards up to the level required by HIPAA.
organisation CHCS
CHCS will also pay a financial penalty of $650,000.
financial $650,000
CHCS will also pay a financial penalty of $650,000.
financial $2.7 million
A penalty of $2.7 million will be paid by OHSU to settle alleged HIPAA violations without admission of liability.
‎November 2, 2015
General Document Context The last update to the HIPAA violation penalty amounts was applied on January 28, 2026, and applies to violations that occurred after November 2, 2015.
industry Finance
General Document Context
industry Health
General Document Context
industry Government
General Document Context
industry Education
General Document Context
industry Retail
General Document Context
industry Legal
General Document Context
‎September 6, 2016
Penalties for HIPAA violation cases prior to September 6, 2016, were adjusted to pre-adjustment civil penalty amounts.
industry Finance
General Document Context
industry Health
General Document Context
industry Government
General Document Context
industry Education
General Document Context
industry Retail
General Document Context
industry Legal
General Document Context
‎February 2017
Associated Press was granted unauthorized access to the PHI of 34,862 individuals at Lafourche Medical Group without first obtaining patient authorization.
organisation COVID-19
OCR launched an investigation after seeing a media article about the medical center’s response to the COVID-19 public health emergency.
organisation Associated Press
The medical center had allowed an Associated Press reporter to have access to the patients and their clinical information without first obtaining authorization from the patients.
organisation the HIPAA Privacy Rule
The disclosures were a violation of the HIPAA Privacy Rule.
financial $160,000
The Case was settled for $160,000.
financial $80,000
The case was settled for $80,000.
financial $500,000
The case was settled with a $500,000 settlement and a corrective action plan.
financial $480,000
OCR settled the alleged HIPAA violations for $480,000.
‎April 1, 2017
General Document Context The forensic investigation confirmed that the attackers first gained access to its network on April 1, 2017.
industry Finance
General Document Context
industry Health
General Document Context
industry Government
General Document Context
industry Education
General Document Context
industry Retail
General Document Context
industry Legal
General Document Context
financial $100,000
The case was settled for $100,000.
financial $1,300,000
The case was settled for $1,300,000.
‎January 2018
The Athens Orthopedic Clinic PA was fined $30,000 for a HIPAA Right of Access violation after hackers stole data and leaked the ePHI of 208,557 patients online.
financial $30,000
After being notified by OCR about a proposed fine of $105,000, Dr. Brockley requested a hearing with an Administrative Law Judge, but settled out of court and agreed to a fine of $30,000.
The HIPAA Right of Access violation was settled with OCR for $30,000.
financial $65,000
The HIPAA Right of Access violation was settled with OCR for $65,000.
The case was settled for $65,000.
financial $25,000
The case was settled with OCR for $25,000.
financial $1.5 million
The case was settled for $1,500,000.
financial $100,000
Dr. Glazer did not cooperate with OCR during the investigation, resulting in OCR imposing a civil monetary penalty of $100,000 for the HIPAA Right of Access violation.
organisation the HIPAA Right of Access
The HIPAA Right of Access violation was settled with OCR for $160,000.
financial $160,000
The HIPAA Right of Access violation was settled with OCR for $160,000.
organisation Rainrock Treatment Center
Rainrock Treatment Center LLC (dba Monte Nido Rainrock), a Eugene, OR-based provider of residential eating disorder treatment services, failed to provide a patient with timely access to the requested medical records after repeated requests.
organisation Monte Nido Rainrock
Rainrock Treatment Center LLC (dba Monte Nido Rainrock), a Eugene, OR-based provider of residential eating disorder treatment services, failed to provide a patient with timely access to the requested medical records after repeated requests.
organisation CHMC
CHMC settled the HIPAA Right of Access case with OCR and paid an $80,000 penalty.
financial $80,000
CHMC settled the HIPAA Right of Access case with OCR and paid an $80,000 penalty.
organisation Peachstate
During the investigation, OCR discovered the business associate had acquired Peachstate, a CLIA-certified laboratory that provides clinical and genetic testing services.
financial $850,000
The case was settled for $850,000.
financial $50,000
The failure to cooperate with the investigation and respond to an administrative subpoena resulted in a civil monetary penalty of $50,000.
financial $10,000
The HIPAA Right of Access violation was settled with OCR for $10,000.
financial $75,000
The HIPAA Right of Access violation was settled with OR for $75,000.
financial $5,000
The HIPAA Right of Access violation was settled with OCR for $5,000.
financial $200,000
The case was settled for $200,000.
financial $70,000
The HIPAA Right of Access violation was settled with OCR for $70,000.
financial $105,000
After being notified by OCR about a proposed fine of $105,000, Dr. Brockley requested a hearing with an Administrative Law Judge, but settled out of court and agreed to a fine of $30,000.
financial $28,000
The case was settled, and a financial penalty of $28,000 was paid.
financial $62,500
The case was settled for $62,500.
financial $32,150
The HIPAA Right of Access violation was settled with OCR for $32,150.
financial $5,100,000
The case was settled for $5,100,000.
financial $6,850,000
The case was settled for $6,850,000.
financial $2,300,000
The case was settled for $2,300,000.
financial $36,000
The case was settled for $36,000.
‎February 2018
BST & Co. CPAs, LLP experienced a HIPAA violation due to unauthorized access of protected health information for up to 170,000 individuals in December 2019.
organisation the HIPAA Right of Access
OCR determined that there had been a violation of the HIPAA Right of Access for not providing the requested records within 30 days.
financial $112,500
The proposed financial penalty was contested, but a $112,500 settlement was ultimately agreed upon.
financial $182,000
The alleged HIPAA violations were settled with a $182,000 financial penalty and a corrective action plan.
‎March 2018
Threat actors gained access to 291,000 files containing patient data, including the protected health information of 85,000 individuals.
financial $250,000
The investigation was settled, and a penalty of $250,000 was paid to resolve the alleged HIPAA violations.
financial $240,000
OCR imposed a civil monetary penalty of $240,000 to resolve the alleged violations.
data_breach 291,0000 files
The hackers gained access to 291,0000 files containing patient data.
‎August 14, 2018
General Document Context A settlement of $85,000 was agreed upon with OCR to resolve the HIPAA violation.
industry Finance
General Document Context
industry Health
General Document Context
industry Government
General Document Context
industry Education
General Document Context
industry Retail
General Document Context
industry Legal
General Document Context
financial $85,000
A settlement of $85,000 was agreed upon with OCR to resolve the HIPAA violation.
‎December 2018
Guam Memorial Hospital Authority agreed to pay a $25,000 financial penalty after OCR confirmed the GandCrab ransomware attack in December 2018 resulted in unauthorized access to ePHI of up to 5,000 individuals.
tactic Ransomware
DMS suffered a GandCrab ransomware attack in December 2018.
organisation Guam Memorial Hospital Authority
OCR agreed to settle the alleged HIPAA violation, and Guam Memorial Hospital Authority agreed to pay a $25,000 financial penalty.
financial $25,000
OCR agreed to settle the alleged HIPAA violation, and Guam Memorial Hospital Authority agreed to pay a $25,000 financial penalty.
‎December 8, 2018
USR Holdings, a data hosting and cloud services provider, experienced unauthorized access to the ePHI of at least 23,868 individuals due to inadequate HIPAA compliance measures.
industry Finance
General Document Context
industry Health
General Document Context
industry Government
General Document Context
industry Education
General Document Context
industry Retail
General Document Context
industry Legal
General Document Context
organisation USR Holdings
OCR investigated and determined that USR Holdings failed to conduct a HIPAA-compliant risk analysis, had not implemented procedures for reviewing records of information system activity, had not established and implemented procedures for creating and maintaining retrievable exact copies of ePHI, and impermissible access to ePHI and the deletion of ePHI.
financial $337,750
USR Holdings settled the alleged violations and paid a $337,750 penalty.
‎February 19, 2019
A Bryan County Ambulance Authority ransomware attack on November 24, 2021, resulted in the unauthorized access of electronic protected health information for 34,310 patients.
industry Finance
General Document Context
industry Health
General Document Context
industry Government
General Document Context
industry Education
General Document Context
industry Retail
General Document Context
industry Legal
General Document Context
financial $100,000
The clinic failed to respond to an offer to informally settle the alleged HIPAA Right of Access violation, resulting in OCR imposing a $100,000 civil monetary penalty.
financial $1,190,000
OCR imposed a civil monetary penalty of $1,190,000 to resolve the alleged violations.
financial $35,581
The case was settled for $35,581.
‎March 2019
OCR received a complaint from a patient alleging BILHBS had not provided a copy of her father’s medical records.
financial $10,000
The case was settled for $10,000.
The impermissible disclosures of PHI resulted in a $10,000 settlement.
financial $25,000
The case was settled for $25,000.
financial $100,000
OCR determined there had been a risk analysis failure, and the case was settled for $100,000.
financial $160,000
The case was settled for $160,000.
organisation Aetna
OCR’s investigation revealed periodic technical and non-technical evaluations of operational changes affecting the security of their electronic PHI had not been performed, procedures had not been implemented to verify the identity of individuals accessing their ePHI, there was a lack of ePHI safeguards, and Aetna had violated the minimum necessary standard.
organisation BILHBS
OCR received a complaint from a patient alleging BILHBS had not provided a copy of her father’s medical records.
organisation Agape Health Services
Operating as Agape Health Services, the company experienced a breach of the ePHI of 1,263 patients.
organisation Sentara Hospitals
Sentara Hospitals reported the breach to OCR as having impacted 8 individuals.
financial $3,000,000
The case was settled for $3 million.
financial $70,000
The case was settled for $70,000.
financial $3,500
The case was settled for $3,500.
financial $202,400
The case was settled for $202,400.
financial $1,000,000
The case was settled for $1,000,000.
financial $38,000
The case was settled for $38,000.
financial $1,040,000
The case was settled for $1,040,000.
financial $85,000
A settlement of $85,000 was agreed upon to resolve the violation.
financial $2.175 million
The case was settled for $2.175 million.
financial $900,000
MIE also settled a multi-state action with state attorneys general and paid a penalty of $900,000.
‎April 2019
OCR issued a Notice of Enforcement Discretion in April 2019 to adjust the maximum annual penalties for HIPAA violations across three penalty tiers.
organisation the Notice of Enforcement Discretion
Under the Notice of Enforcement Discretion, the maximum annual penalty for a violation will be capped at $25,000 for Tier 1, $100,000 for Tier 2, and $250,000 for Tier 3, plus annual inflation increases.
The Notice of Enforcement Discretion only applied a new annual penalty cap in three of the four penalty tiers.
organisation Notice of Enforcement Discretion
In April 2019, OCR reexamined the language of the HITECH Act and determined it had been misinterpreted and issued a Notice of Enforcement Discretion stating that the maximum annual penalties in three of the four penalty tiers would be changed.
financial $25,000
Under the Notice of Enforcement Discretion, the maximum annual penalty for a violation will be capped at $25,000 for Tier 1, $100,000 for Tier 2, and $250,000 for Tier 3, plus annual inflation increases.
financial $100,000
Under the Notice of Enforcement Discretion, the maximum annual penalty for a violation will be capped at $25,000 for Tier 1, $100,000 for Tier 2, and $250,000 for Tier 3, plus annual inflation increases.
financial $250,000
Under the Notice of Enforcement Discretion, the maximum annual penalty for a violation will be capped at $25,000 for Tier 1, $100,000 for Tier 2, and $250,000 for Tier 3, plus annual inflation increases.
‎June 2019
When issuing notification letters, 1,531 letters were sent to incorrect addresses, resulting in an impermissible disclosure of patients’ demographic information.
financial $3,000,000
Solara settled the alleged violations and paid a $3,000,000 financial penalty.
‎June 21, 2019
PIH Health paid a $600,000 financial penalty after the Guam Memorial Hospital Authority was found to have violated HIPAA regulations following a December 2018 ransomware attack.
industry Finance
General Document Context
industry Health
General Document Context
industry Government
General Document Context
industry Education
General Document Context
industry Retail
General Document Context
industry Legal
General Document Context
organisation PIH Health
The alleged violations were settled, and PIH Health paid a $600,000 financial penalty.
financial $600,000
The alleged violations were settled, and PIH Health paid a $600,000 financial penalty.
‎late 2019
OCR's HIPAA Right of Access enforcement initiative was launched in late 2019.
organisation OCR’s HIPAA Right of Access
The 2020 increase is largely due to OCR’s HIPAA Right of Access enforcement initiative, which was launched in late 2019.
‎November 5, 2019
Green Ridge Behavioral Health failed to conduct an accurate risk analysis and had policies and procedures for reviewing records of information system activity, resulting in the impermissible disclosure of PHI of more than 14,000 patients.
industry Finance
General Document Context
industry Health
General Document Context
industry Government
General Document Context
industry Education
General Document Context
industry Retail
General Document Context
industry Legal
General Document Context
infrastructure Windows
In 2017, Heritage Valley fell victim to a NotPetya ransomware attack that prevented access to its Windows devices.
financial $100,000
West Caldwell Care Center accepted that the records were not provided within 30 days, but submitted evidence of mitigating factors; however, they were rejected by OCR, which imposed a civil monetary penalty of $100,000.
financial $250,000
OCR proposed a $250,000 financial penalty; however, the proposed fine was contested, and a hearing was requested with an Administrative Law Judge (ALJ).
organisation American Medical Response
OCR determined that there had been a violation of the HIPAA Right of Access and provided American Medical Response with the opportunity to settle; however, American Medical Response chose not to, resulting in a civil monetary penalty being imposed for $115,200 to resolve the HIPAA violation.
financial $115,200
OCR determined that there had been a violation of the HIPAA Right of Access and provided American Medical Response with the opportunity to settle; however, American Medical Response chose not to, resulting in a civil monetary penalty being imposed for $115,200 to resolve the HIPAA violation.
organisation West Caldwell Care Center
OCR investigated and notified West Caldwell Care Center of its intention to impose a financial penalty, but West Caldwell Care Center disagreed with OCR’s determination.
organisation the Departmental Appeals Board
The fine was appealed, but the Departmental Appeals Board did not reduce the fine.
organisation the HIPAA Privacy and Security Rules
OCR investigated and identified multiple potential violations of the HIPAA Privacy and Security Rules.
organisation Green Ridge Behavioral Health
Green Ridge Behavioral Health was determined to have failed to conduct an accurate risk analysis, failed to reduce risks to ePHI, did not have policies and procedures for reviewing records of information system activity, and there was an impermissible disclosure of the PHI of more than 14,000 patients.
financial $70,000
The ALJ upheld OCR’s determination but reduced the financial penalty to $70,000.
financial $950,000
OCR agreed to settle the alleged violations for $950,000.
financial $35,000
OCR then proposed a $35,000 settlement on the basis that the penalty was not further contested.
financial $40,000
Green Ridge Behavioral Health settled the alleged violations with no admission of wrongdoing and paid a $40,000 penalty.
‎January 2020
Hackers had access to the system between April 2019 and January 2020.
organisation Northeast Radiology
The alleged violation was settled, and Northeast Radiology agreed to pay a $350,000 financial penalty.
financial $350,000
The alleged violation was settled, and Northeast Radiology agreed to pay a $350,000 financial penalty.
financial $240,000
OCR settled the case for $240,000.
‎December 2020
Regional Women's Health Group failed to conduct a HIPAA-compliant, organization-wide risk analysis and inform the HHS, media, and affected individuals about a security breach involving its Picture Archiving and Communication System (PACS) server.
tactic Ransomware
In December 2020, the practice fell victim to a ransomware attack that saw hackers encrypt medical records and gain access to the electronic protected health information of 6,800 individuals.
general_metric 6,800 individuals
In December 2020, the practice fell victim to a ransomware attack that saw hackers encrypt medical records and gain access to the electronic protected health information of 6,800 individuals.
financial $25,000
A settlement was reached, and Comprehensive Neurology agreed to pay a $25,000 financial penalty to resolve the alleged HIPAA Security Rule violation.
organisation Regional Women’s Health Group
OCR investigated and determined that Regional Women’s Health Group had failed to conduct a HIPAA-compliant, organization-wide risk analysis to identify risks and vulnerabilities to ePHI.
organisation Vision Upright
OCR determined that Vision Upright MRI had never conducted a HIPAA-compliant risk analysis to identify risks and vulnerabilities to ePHI, and failed to inform the HHS, the media, and the affected individuals about a security breach involving its Picture Archiving and Communication System (PACS) server.
financial $320,000
The case was resolved with a $320,000 financial penalty and a corrective action plan to address the noncompliance issues identified by OCR.
financial $5,000
A settlement was agreed, and Vision Upright MRI agreed to pay $5,000 to resolve the alleged violations.
‎February 5, 2021
Children's Hospital Colorado failed to provide HIPAA Privacy Rule training to 6,666 members of its workforce and conduct a HIPAA-compliant risk analysis until February 5, 2021.
industry Finance
General Document Context
industry Health
General Document Context
industry Government
General Document Context
industry Education
General Document Context
industry Retail
General Document Context
industry Legal
General Document Context
target_region United States
The investigation also revealed that Children’s Hospital Colorado failed to provide HIPAA Privacy Rule training to 6,666 members of the workforce, including 3,495 nursing students, and a HIPAA-compliant risk analysis had not been conducted until February 5, 2021.
organisation Children’s Hospital
The investigation also revealed that Children’s Hospital Colorado failed to provide HIPAA Privacy Rule training to 6,666 members of the workforce, including 3,495 nursing students, and a HIPAA-compliant risk analysis had not been conducted until February 5, 2021.
data_breach 6,666 members
The investigation also revealed that Children’s Hospital Colorado failed to provide HIPAA Privacy Rule training to 6,666 members of the workforce, including 3,495 nursing students, and a HIPAA-compliant risk analysis had not been conducted until February 5, 2021.
general_metric 3,495 nursing students
The investigation also revealed that Children’s Hospital Colorado failed to provide HIPAA Privacy Rule training to 6,666 members of the workforce, including 3,495 nursing students, and a HIPAA-compliant risk analysis had not been conducted until February 5, 2021.
organisation HIPAA Privacy and Security Rule
OCR imposed a civil monetary penalty of $548,265 to resolve the alleged HIPAA Privacy and Security Rule violations.
financial $548,265
OCR imposed a civil monetary penalty of $548,265 to resolve the alleged HIPAA Privacy and Security Rule violations.
‎March 25, 2021
OCr received a complaint on March 25, 2021, from a patient who claimed not to have been provided with their requested medical records.
industry Finance
General Document Context
industry Health
General Document Context
industry Government
General Document Context
industry Education
General Document Context
industry Retail
General Document Context
industry Legal
General Document Context
organisation UnitedHealthcare
OCR notified UnitedHealthcare about the complaint, and the failure to provide the records was attributed to an employee error.
financial $80,000
OCR determined there had been a HIPAA Right of Access failure, and UnitedHealthcare was fined $80,000.
financial $75,000
The case was settled for $75,000.
financial $240,000
The case was settled with OCR for $240,000.
data_breach 419 medical records
OCR investigated a report of snooping on 419 medical records by 23 security guards in the emergency department.
‎September 29, 2021
Threat actors gained access to the email accounts of 8 Solara Medical Supplies employees between April and June 2019.
industry Finance
General Document Context
industry Health
General Document Context
industry Government
General Document Context
industry Education
General Document Context
industry Retail
General Document Context
industry Legal
General Document Context
organisation Memorial Health System
OCR determined that this was a violation of the HIPAA Right of Access; however Memorial Health System disagreed with the determination, as a copy of the EEG tracing had been provided to the patient on a previous occasion; however, the case was settled to avoid the time and cost of litigation and Memorial Health System paid a $60,000 penalty.
financial $60,000
OCR determined that this was a violation of the HIPAA Right of Access; however Memorial Health System disagreed with the determination, as a copy of the EEG tracing had been provided to the patient on a previous occasion; however, the case was settled to avoid the time and cost of litigation and Memorial Health System paid a $60,000 penalty.
‎October 2021
MMG Fusion failed to conduct a HIPAA-compliant, organization-wide risk analysis and impermissibly disclosed the ePHI of 9,316 individuals.
organisation MMG Fusion
OCR determined that there had been an impermissible disclosure of the PHI of 15 million patients, in violation of the HIPAA Privacy Rule; that an accurate and thorough risk analysis had not been conducted as required by the HIPAA Security Rule; and MMG Fusion failed to notify the affected covered entity clients about the data breach, in violation of the HIPAA Breach Notification Rule.
organisation the HIPAA Breach Notification Rule
OCR determined that there had been an impermissible disclosure of the PHI of 15 million patients, in violation of the HIPAA Privacy Rule; that an accurate and thorough risk analysis had not been conducted as required by the HIPAA Security Rule; and MMG Fusion failed to notify the affected covered entity clients about the data breach, in violation of the HIPAA Breach Notification Rule.
organisation Star Group
OCR investigated and determined that Star Group had failed to conduct a HIPAA-compliant, organization-wide risk analysis to identify risks and vulnerabilities to ePHI, and had impermissibly disclosed the ePHI of 9,316 individuals.
organisation MMG Fusion’s
OCR’s investigation confirmed that in 2020, MMG Fusion’s systems were accessed by an unauthorized third party, who stole data and posted it on the dark web.
financial $245,000
The case was resolved with a $245,000 financial penalty and a corrective action plan to address the noncompliance issues identified by OCR.
financial $10,000
OCR settled the alleged violations, and MMG Fusion agreed to pay a $10,000 financial penalty.
‎October 31, 2021
Virtual Private Network Solutions failed to conduct a comprehensive and accurate risk analysis, leading OCR to investigate and determine that Elgon Information Systems had experienced a ransomware attack.
industry Finance
General Document Context
industry Health
General Document Context
industry Government
General Document Context
industry Education
General Document Context
industry Retail
General Document Context
industry Legal
General Document Context
organisation Virtual Private Network Solutions
OCR investigated and determined that Virtual Private Network Solutions had failed to conduct a comprehensive and accurate risk analysis to identify all risks and vulnerabilities to ePHI.
financial $90,000
The HIPAA violation case was settled for $90,000.
‎November 24, 2021
Bryan County Ambulance Authority failed to conduct a risk analysis, leading OCR to impose a $70,000 civil monetary penalty for failing to provide timely access to medical records.
industry Finance
General Document Context
industry Health
General Document Context
industry Government
General Document Context
industry Education
General Document Context
industry Retail
General Document Context
industry Legal
General Document Context
data_breach 10,023 members
Hackers had access to its network from November 24, 2021, to November 26, 2021, including servers containing the ePHI of 10,023 members of its employee-sponsored health and wellness plan.
organisation Bryan County Ambulance Authority
OCR investigated and determined that Bryan County Ambulance Authority had never conducted a risk analysis to identify potential risks and vulnerabilities to ePHI.
organisation the Right of Access
OCR stated that the fee was not appropriate since the patient requested the records be sent via email, and the belief that the information would be used for fraud was not a valid reason for a denial of the Right of Access request under the HIPAA Privacy Rule.
financial $90,000
The alleged violation was settled for $90,000.
financial $25
The practice claimed the complainant would not pay a $25 administrative fee for mailing the records (certified mail) and that the request was denied because the practice believed she would use the information to commit insurance fraud.
financial $70,000
A civil monetary penalty of $70,000 was imposed for failing to provide timely access to medical records, in violation of the HIPAA Right of Access.
‎January 2022
Spencer Gifts was fined $450,000 and required to implement a corrective action plan after OCR determined the company failed to conduct a HIPAA-compliant risk analysis.
tactic Data Breach
OCR was informed of the data breach in January 2022 and determined that Spencer Gifts had failed to conduct a HIPAA-compliant risk analysis and did not have sufficient HIPAA Privacy Rule, Security Rule, and Breach Notification Rule policies and procedures.
organisation HIPAA Privacy Rule
OCR was informed of the data breach in January 2022 and determined that Spencer Gifts had failed to conduct a HIPAA-compliant risk analysis and did not have sufficient HIPAA Privacy Rule, Security Rule, and Breach Notification Rule policies and procedures.
organisation Breach Notification Rule
OCR was informed of the data breach in January 2022 and determined that Spencer Gifts had failed to conduct a HIPAA-compliant risk analysis and did not have sufficient HIPAA Privacy Rule, Security Rule, and Breach Notification Rule policies and procedures.
financial $450,000
The alleged HIPAA violations were resolved with a $450,000 financial penalty and the adoption of a corrective action plan.
‎June 2022
Northeast Surgical Group experienced unauthorized access to ePHI and encryption of patient data due to a ransomware attack in 2023.
tactic Data Breach
Further data breach reports were filed with OCR in September 2019, January 2020, April 2020, and June 2022, which were also due to credential stuffing attacks, although the subsequent attacks only affected 484 individuals.
tactic Credential Stuffing
Further data breach reports were filed with OCR in September 2019, January 2020, April 2020, and June 2022, which were also due to credential stuffing attacks, although the subsequent attacks only affected 484 individuals.
general_metric 484 individuals
Further data breach reports were filed with OCR in September 2019, January 2020, April 2020, and June 2022, which were also due to credential stuffing attacks, although the subsequent attacks only affected 484 individuals.
organisation Northeast Surgical Group
OCR investigated and determined that Northeast Surgical Group has not conducted a comprehensive and accurate risk analysis to identify risks and vulnerabilities to all ePHI.
financial $10,000
The HIPAA violation case was settled with a $10,000 penalty.
‎November 2022
Top of the World Ranch Treatment Center agreed to pay a $103,000 financial penalty and adopt a corrective action plan in November 2022.
organisation the World Ranch Treatment Center
The case was settled, and Top of the World Ranch Treatment Center agreed to pay a $103,000 financial penalty to settle the alleged violation and adopt a corrective action plan to address all areas of noncompliance.
financial $103,000
The case was settled, and Top of the World Ranch Treatment Center agreed to pay a $103,000 financial penalty to settle the alleged violation and adopt a corrective action plan to address all areas of noncompliance.
‎March 25, 2023
A ransomware group accessed Elgon Information Systems' systems via open ports on its firewall, resulting in unauthorized access to the ePHI of 31,248 individuals.
industry Finance
General Document Context
industry Health
General Document Context
industry Government
General Document Context
industry Education
General Document Context
industry Retail
General Document Context
industry Legal
General Document Context
tactic Ransomware
The investigation revealed the ransomware group first accessed its systems on March 25, 2023, via open ports on its firewall.
organisation Elgon Information Systems
OCR investigated and determined that Elgon Information Systems had failed to conduct a comprehensive and accurate risk analysis to identify all risks and vulnerabilities to ePHI.
financial $80,000
The HIPAA violation case was settled, and Elgon Information Systems paid an $80,000 penalty.
‎January 19, 2024
A university agreed to a $227,816 financial penalty after the OCR determined that a HIPAA-compliant risk analysis was not completed until January 19, 2024.
industry Finance
General Document Context
industry Health
General Document Context
industry Government
General Document Context
industry Education
General Document Context
industry Retail
General Document Context
industry Legal
General Document Context
financial $227,816
A settlement was agreed upon that included a $227,816 financial penalty.
financial $200,000
OCR gave the university the opportunity to settle the case informally, but when a settlement could not be agreed, OCR proceeded to impose a civil monetary penalty of $200,000.
‎2025/10/30
Triple S was required to pay a HIPAA violation penalty of $1.5 million after the fine was reduced on appeal, following a failure to comply with the Health Insurance Portability and Accountability Act's Privacy Rule in Puerto Rico.
target_region Puerto Rico
Triple S was also required to pay a HIPAA violation penalty of $6.8 million to the Puerto Rico Health Insurance Administration for a failure to comply with the Health Insurance Portability and Accountability Act’s Privacy Rule last year, although the HIPAA violation fine was reduced to $1.5 million on appeal.
organisation the Puerto Rico Health Insurance Administration
Triple S was also required to pay a HIPAA violation penalty of $6.8 million to the Puerto Rico Health Insurance Administration for a failure to comply with the Health Insurance Portability and Accountability Act’s Privacy Rule last year, although the HIPAA violation fine was reduced to $1.5 million on appeal.
financial $6.8 million
Triple S was also required to pay a HIPAA violation penalty of $6.8 million to the Puerto Rico Health Insurance Administration for a failure to comply with the Health Insurance Portability and Accountability Act’s Privacy Rule last year, although the HIPAA violation fine was reduced to $1.5 million on appeal.
financial $1.5 million
Triple S was also required to pay a HIPAA violation penalty of $6.8 million to the Puerto Rico Health Insurance Administration for a failure to comply with the Health Insurance Portability and Accountability Act’s Privacy Rule last year, although the HIPAA violation fine was reduced to $1.5 million on appeal.
‎January 2026
OCR has settled or imposed civil monetary penalties in over 50 HIPAA violation cases under its new enforcement initiative targeting noncompliance with the risk analysis provision of the HIPAA Security Rule.
financial $73,011
A violation that occurred despite reasonable vigilance can attract a fine of $1,461 – $73,011.
A violation due to willful neglect, which is corrected within thirty days, will attract a fine of between $14,602 and $73,011.
A violation due to willful neglect, which is not corrected within thirty days, will attract a fine of between $73,011 and $2,190,294.
financial $2,190,294
A violation due to willful neglect, which is not corrected within thirty days, will attract a fine of between $73,011 and $2,190,294.
The maximum financial penalty for willful neglect of the HIPAA Rules is $2,190,294 per violation category, per year.
infrastructure 50 HIPAA violation cases
As of January 2026, OCR has settled or imposed civil monetary penalties in more than 50 HIPAA violation cases under this compliance initiative.
organisation HIPAA Security Rule
Since this is the main focus of OCR when investigating hacking-related data breaches, not only will it help to improve compliance with this vital HIPAA Security Rule requirement, but it should also help to accelerate data breach investigations, allowing OCR to clear the backlog of investigations more rapidly.
financial $145
A violation of HIPAA attributable to ignorance of the HIPAA Rules can attract a fine of $145 – $36,505.50.
financial $36,505.50
A violation of HIPAA attributable to ignorance of the HIPAA Rules can attract a fine of $145 – $36,505.50.
financial $1,461
A violation that occurred despite reasonable vigilance can attract a fine of $1,461 – $73,011.
financial $14,602
A violation due to willful neglect, which is corrected within thirty days, will attract a fine of between $14,602 and $73,011.
organisation the HIPAA Security Rule
In 2024, OCR announced a new enforcement initiative targeting noncompliance with the risk analysis provision of the HIPAA Security Rule.
organisation Security Rule
In OCR’s last round of HIPAA audits in 2016 and 2017, most audited entities were not fully compliant with this important Security Rule provision, as they had either failed to conduct a HIPAA-compliant risk analysis, had not conducted one frequently enough, or their risk analyses were not comprehensive and/or accurate.
organisation HIPAA Rules
By increasing its enforcement activity, OCR is sending a message to all covered entities, large and small, that violations of HIPAA Rules will not be tolerated.
organisation the HHS’ Office for Civil Rights
The consequences of violating HIPAA can be significant, and it is important to note that fines for a HIPAA violation can be applied by the HHS’ Office for Civil Rights (OCR) even if no breach of PHI has occurred.
‎early 2026
The OCR Director confirmed in early 2026 that the enforcement initiative targeting noncompliance with the risk analysis provision of the HIPAA Security Rule will continue.
‎January 28, 2026
The Office of Management and Budget set the inflation multiplier for 2025 as 1.02598, which was applied to update HIPAA violation penalty amounts effective January 28, 2026.
industry Finance
General Document Context
industry Health
General Document Context
industry Government
General Document Context
industry Education
General Document Context
industry Retail
General Document Context
industry Legal
General Document Context
infrastructure 505.50
Annual Penalty Limit  Annual Penalty Limit  Minimum Penalty per Violation Maximum Penalty per Violation Annual Penalty Cap Tier 1 Lack of Knowledge $145 $36,505.50 $36,505.50 Tier 2 Reasonable Cause  $1,461 $73,011 $146,053 Tier 3 Willful Neglect $14,602 $73,011 $365,052 Tier 4 Willful neglect (not corrected within 30 days $73,011 $2,…
financial $145
Annual Penalty Limit  Annual Penalty Limit  Minimum Penalty per Violation Maximum Penalty per Violation Annual Penalty Cap Tier 1 Lack of Knowledge $145 $36,505.50 $36,505.50 Tier 2 Reasonable Cause  $1,461 $73,011 $146,053 Tier 3 Willful Neglect $14,602 $73,011 $365,052 Tier 4 Willful neglect (not corrected within 30 days $73,011 $2,…
general_metric 2 36,505.50 Reasonable Cause
Annual Penalty Limit  Annual Penalty Limit  Minimum Penalty per Violation Maximum Penalty per Violation Annual Penalty Cap Tier 1 Lack of Knowledge $145 $36,505.50 $36,505.50 Tier 2 Reasonable Cause  $1,461 $73,011 $146,053 Tier 3 Willful Neglect $14,602 $73,011 $365,052 Tier 4 Willful neglect (not corrected within 30 days $73,011 $2,…
financial $1,461
Annual Penalty Limit  Annual Penalty Limit  Minimum Penalty per Violation Maximum Penalty per Violation Annual Penalty Cap Tier 1 Lack of Knowledge $145 $36,505.50 $36,505.50 Tier 2 Reasonable Cause  $1,461 $73,011 $146,053 Tier 3 Willful Neglect $14,602 $73,011 $365,052 Tier 4 Willful neglect (not corrected within 30 days $73,011 $2,…
financial $73,011
Annual Penalty Limit  Annual Penalty Limit  Minimum Penalty per Violation Maximum Penalty per Violation Annual Penalty Cap Tier 1 Lack of Knowledge $145 $36,505.50 $36,505.50 Tier 2 Reasonable Cause  $1,461 $73,011 $146,053 Tier 3 Willful Neglect $14,602 $73,011 $365,052 Tier 4 Willful neglect (not corrected within 30 days $73,011 $2,…
financial $146,053
Annual Penalty Limit  Annual Penalty Limit  Minimum Penalty per Violation Maximum Penalty per Violation Annual Penalty Cap Tier 1 Lack of Knowledge $145 $36,505.50 $36,505.50 Tier 2 Reasonable Cause  $1,461 $73,011 $146,053 Tier 3 Willful Neglect $14,602 $73,011 $365,052 Tier 4 Willful neglect (not corrected within 30 days $73,011 $2,…
financial $14,602
Annual Penalty Limit  Annual Penalty Limit  Minimum Penalty per Violation Maximum Penalty per Violation Annual Penalty Cap Tier 1 Lack of Knowledge $145 $36,505.50 $36,505.50 Tier 2 Reasonable Cause  $1,461 $73,011 $146,053 Tier 3 Willful Neglect $14,602 $73,011 $365,052 Tier 4 Willful neglect (not corrected within 30 days $73,011 $2,…
financial $365,052
Annual Penalty Limit  Annual Penalty Limit  Minimum Penalty per Violation Maximum Penalty per Violation Annual Penalty Cap Tier 1 Lack of Knowledge $145 $36,505.50 $36,505.50 Tier 2 Reasonable Cause  $1,461 $73,011 $146,053 Tier 3 Willful Neglect $14,602 $73,011 $365,052 Tier 4 Willful neglect (not corrected within 30 days $73,011 $2,…
general_metric 4 Tier
Annual Penalty Limit  Annual Penalty Limit  Minimum Penalty per Violation Maximum Penalty per Violation Annual Penalty Cap Tier 1 Lack of Knowledge $145 $36,505.50 $36,505.50 Tier 2 Reasonable Cause  $1,461 $73,011 $146,053 Tier 3 Willful Neglect $14,602 $73,011 $365,052 Tier 4 Willful neglect (not corrected within 30 days $73,011 $2,…
financial $2,190,294
Annual Penalty Limit  Annual Penalty Limit  Minimum Penalty per Violation Maximum Penalty per Violation Annual Penalty Cap Tier 1 Lack of Knowledge $145 $36,505.50 $36,505.50 Tier 2 Reasonable Cause  $1,461 $73,011 $146,053 Tier 3 Willful Neglect $14,602 $73,011 $365,052 Tier 4 Willful neglect (not corrected within 30 days $73,011 $2,…
organisation the Office of Management and Budget
The inflation multiplier for 2025 was set by the Office of Management and Budget (OMB) as 1.02598.
‎2026/10/30
OCR identified multiple violations of the HIPAA Security Rule and Breach Notification Rule in Lehigh Valley Health Network, Montefiore Medical Center, Cottage Health, University of Washington Medicine, and Premera Blue Cross.
organisation Lehigh Valley Health Network
Your Privacy Respected HIPAA Violation Cases 2026 Lehigh Valley Health Network Lehigh Valley Health Network, a Pennsylvania health system, was investigated in response to a ransomware-related data breach that involved the PHI of 248,359 individuals.
organisation the Department of Health and Human Services
HIPAA Violation Cases: Types & Consequences HIPAA violation cases are compliance investigations that result from a data breach being reported to the Department of Health and Human Services’ (HHS) Office for Civil Rights (OCR) or a privacy complaint being submitted to OCR via the complaints portal.
organisation OCR
HIPAA Violation Cases: Types & Consequences HIPAA violation cases are compliance investigations that result from a data breach being reported to the Department of Health and Human Services’ (HHS) Office for Civil Rights (OCR) or a privacy complaint being submitted to OCR via the complaints portal.
organisation PHI
…Business Associate Agreement failures Failure to comply with the General Provisions for Transactions Detailed below is a summary of all HIPAA violation cases that have resulted in civil monetary penalties or settlements with OCR, including cases that have been pursued by OCR after potential HIPAA violations were discovered during data breach investigations and investigations of complaints.
organisation Business Associate Agreement
…Business Associate Agreement failures Failure to comply with the General Provisions for Transactions Detailed below is a summary of all HIPAA violation cases that have resulted in civil monetary penalties or settlements with OCR, including cases that have been pursued by OCR after potential HIPAA violations were discovered during data breach investigations and investigations of complaints.
organisation University of Washington Medicine
Your Privacy Respected HIPAA Violation Cases 2015 University of Washington Medicine – Failure to Conduct Risk Analysis The University of Washington Medicine has agreed to settle with the Department of Health and Human Services’ Office for Civil Rights and will pay a HIPAA fine of $750,000 for potential HIPAA violations stemming from a 90,000-record data breach suffered in 2013.
organisation The University of Washington Medicine
Your Privacy Respected HIPAA Violation Cases 2015 University of Washington Medicine – Failure to Conduct Risk Analysis The University of Washington Medicine has agreed to settle with the Department of Health and Human Services’ Office for Civil Rights and will pay a HIPAA fine of $750,000 for potential HIPAA violations stemming from a 90,000-record data breach suffered in 2013.
infrastructure 2015 HIPAA Violation Cases
Your Privacy Respected HIPAA Violation Cases 2015 University of Washington Medicine – Failure to Conduct Risk Analysis The University of Washington Medicine has agreed to settle with the Department of Health and Human Services’ Office for Civil Rights and will pay a HIPAA fine of $750,000 for potential HIPAA violations stemming from a 90,000-record data breach suffered in 2013.
financial $750,000
Your Privacy Respected HIPAA Violation Cases 2015 University of Washington Medicine – Failure to Conduct Risk Analysis The University of Washington Medicine has agreed to settle with the Department of Health and Human Services’ Office for Civil Rights and will pay a HIPAA fine of $750,000 for potential HIPAA violations stemming from a 90,000-record data breach suffered in 2013.
data_breach 90,000 record
Your Privacy Respected HIPAA Violation Cases 2015 University of Washington Medicine – Failure to Conduct Risk Analysis The University of Washington Medicine has agreed to settle with the Department of Health and Human Services’ Office for Civil Rights and will pay a HIPAA fine of $750,000 for potential HIPAA violations stemming from a 90,000-record data breach suffered in 2013.
organisation Types & Consequences
HIPAA Violation Cases: Types & Consequences.
organisation HIPAA
When OCR identifies a violation of HIPAA, violation cases can be resolved in multiple ways.
organisation the HIPAA Rules
When there has been a serious violation of the HIPAA Rules or evidence is found suggesting widespread noncompliance, OCR may initiate a more extensive review.
organisation CAP
These settlements involve a reduced financial penalty and generally include a corrective action plan (CAP) with specific measures the regulated entity must implement to ensure compliance with the HIPAA Rules.
organisation Cybersecurity Consultation
Avail of a Free 30-Minute Cybersecurity Consultation with Blue Team Alpha Review your security program, get advice on a specific cybersecurity concern, identify risk-reduction priorities, or take the first step toward your annual HIPAA Security Risk Assessment.
infrastructure 22 HIPAA violation cases
In 2022, OCR resolved 22 HIPAA violation cases with financial penalties, and while there was a dip in enforcement actions in 2023 to just 13 penalties, they rose to 16 in 2024 and 21 in 2025.
organisation HIPAA Journal
Your Privacy Respected OCR’s enforcement initiatives are effective at changing behavior, as can be seen by the falling numbers of penalties for HIPAA Right of Access violations in 2025.
organisation HIPAA Right of Access
Your Privacy Respected OCR’s enforcement initiatives are effective at changing behavior, as can be seen by the falling numbers of penalties for HIPAA Right of Access violations in 2025.
organisation Montefiore Medical Center
OCR determined that Montefiore Medical Center had failed to conduct an accurate and thorough risk analysis of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI; failed to implement procedures to review records of activity in information systems, and failed to implement hardware, software, or procedural mechanisms to record and examine activity in…
organisation Premera Blue Cross
Your Privacy Respected HIPAA Violation Cases 2020 Premera Blue Cross Mountlake Terrace, WA-based Premera Blue Cross is the largest health plan in the Pacific Northwest.
infrastructure 2020 Journal HIPAA Violation Cases
Your Privacy Respected HIPAA Violation Cases 2020 Premera Blue Cross Mountlake Terrace, WA-based Premera Blue Cross is the largest health plan in the Pacific Northwest.
organisation Cottage Health
Your Privacy Respected HIPAA Violation Cases 2018 Cottage Health – Exposure of ePHI Over the Internet OCR agreed to settle multiple alleged HIPAA violations with Cottage Health for $3,000,000.
financial $3,000,000
Your Privacy Respected HIPAA Violation Cases 2018 Cottage Health – Exposure of ePHI Over the Internet OCR agreed to settle multiple alleged HIPAA violations with Cottage Health for $3,000,000.
Tactical Metrics
Metrics
financial
$25K
Fine / Penalty
OCR agreed to settle the alleged HIPAA violation, and Guam Memorial Hospital Authority agreed to pay a $25,000 financial penalty.
Under the Notice of Enforcement Discretion, the maximum annual penalty for a violation will be capped at $25,000 for Tier 1, $100,000 for Tier 2, and $250,000 for Tier 3, plus annual inflation increases.
A settlement was reached, and Comprehensive Neurology agreed to pay a $25,000 financial penalty to resolve the alleged HIPAA Security Rule violation.
A settlement was agreed upon with OCR that included a $25,000 penalty.
The case was settled with OCR for $25,000.
The case was settled for $25,000.
Metrics
financial
$6.8M
Fine / Penalty
Triple S was also required to pay a HIPAA violation penalty of $6.8 million to the Puerto Rico Health Insurance Administration for a failure to comply with the Health Insurance Portability and Accountability Act’s Privacy Rule last year, although the HIPAA violation fine was reduced to $1.5 million on appeal.
Metrics
financial
$1.5M
Fine / Penalty
Triple S was also required to pay a HIPAA violation penalty of $6.8 million to the Puerto Rico Health Insurance Administration for a failure to comply with the Health Insurance Portability and Accountability Act’s Privacy Rule last year, although the HIPAA violation fine was reduced to $1.5 million on appeal.
The case was settled for $1,500,000.
Metrics
infrastructure
‎Windows
Affected Product
In 2017, Heritage Valley fell victim to a NotPetya ransomware attack that prevented access to its Windows devices.
Metrics
infrastructure
2,015
Hipaa Violation Cases
Your Privacy Respected HIPAA Violation Cases 2015 University of Washington Medicine – Failure to Conduct Risk Analysis The University of Washington Medicine has agreed to settle with the Department of Health and Human Services’ Office for Civil Rights and will pay a HIPAA fine of $750,000 for potential HIPAA violations stemming from a 90,000-record data breach suffered in 2013.
Metrics
financial
$750K
Fine / Penalty
Your Privacy Respected HIPAA Violation Cases 2015 University of Washington Medicine – Failure to Conduct Risk Analysis The University of Washington Medicine has agreed to settle with the Department of Health and Human Services’ Office for Civil Rights and will pay a HIPAA fine of $750,000 for potential HIPAA violations stemming from a 90,000-record data breach suffered in 2013.
Raleigh Orthopaedic has agreed to pay OCR $750,000 for failing to enter into a business associate agreement (BAA) with a vendor before handing over the protected health information (PHI) of 17,300 patients in 2013.
Metrics
data_breach
90,000
Record
Your Privacy Respected HIPAA Violation Cases 2015 University of Washington Medicine – Failure to Conduct Risk Analysis The University of Washington Medicine has agreed to settle with the Department of Health and Human Services’ Office for Civil Rights and will pay a HIPAA fine of $750,000 for potential HIPAA violations stemming from a 90,000-record data breach suffered in 2013.
Metrics
data_breach
498
Records
The settlement for HIPAA violations was reached with SEMC for violations that led to a document sharing system data breach that exposed 498 records, and a data breach involving the theft of a flash drive containing unencrypted data of 595 patients.
Metrics
infrastructure
‎505.50
Software Version
Annual Penalty Limit  Annual Penalty Limit  Minimum Penalty per Violation Maximum Penalty per Violation Annual Penalty Cap Tier 1 Lack of Knowledge $145 $36,505.50 $36,505.50 Tier 2 Reasonable Cause  $1,461 $73,011 $146,053 Tier 3 Willful Neglect $14,602 $73,011 $365,052 Tier 4 Willful neglect (not corrected within 30 days $73,011 $2,…
Metrics
financial
$145
Financial Impact
Annual Penalty Limit  Annual Penalty Limit  Minimum Penalty per Violation Maximum Penalty per Violation Annual Penalty Cap Tier 1 Lack of Knowledge $145 $36,505.50 $36,505.50 Tier 2 Reasonable Cause  $1,461 $73,011 $146,053 Tier 3 Willful Neglect $14,602 $73,011 $365,052 Tier 4 Willful neglect (not corrected within 30 days $73,011 $2,…
A violation of HIPAA attributable to ignorance of the HIPAA Rules can attract a fine of $145 – $36,505.50.
Metrics
financial
$1.5K
Financial Impact
Annual Penalty Limit  Annual Penalty Limit  Minimum Penalty per Violation Maximum Penalty per Violation Annual Penalty Cap Tier 1 Lack of Knowledge $145 $36,505.50 $36,505.50 Tier 2 Reasonable Cause  $1,461 $73,011 $146,053 Tier 3 Willful Neglect $14,602 $73,011 $365,052 Tier 4 Willful neglect (not corrected within 30 days $73,011 $2,…
A violation that occurred despite reasonable vigilance can attract a fine of $1,461 – $73,011.
Metrics
financial
$73K
Financial Impact
Annual Penalty Limit  Annual Penalty Limit  Minimum Penalty per Violation Maximum Penalty per Violation Annual Penalty Cap Tier 1 Lack of Knowledge $145 $36,505.50 $36,505.50 Tier 2 Reasonable Cause  $1,461 $73,011 $146,053 Tier 3 Willful Neglect $14,602 $73,011 $365,052 Tier 4 Willful neglect (not corrected within 30 days $73,011 $2,…
A violation that occurred despite reasonable vigilance can attract a fine of $1,461 – $73,011.
A violation due to willful neglect, which is corrected within thirty days, will attract a fine of between $14,602 and $73,011.
A violation due to willful neglect, which is not corrected within thirty days, will attract a fine of between $73,011 and $2,190,294.
Metrics
financial
$146K
Financial Impact
Annual Penalty Limit  Annual Penalty Limit  Minimum Penalty per Violation Maximum Penalty per Violation Annual Penalty Cap Tier 1 Lack of Knowledge $145 $36,505.50 $36,505.50 Tier 2 Reasonable Cause  $1,461 $73,011 $146,053 Tier 3 Willful Neglect $14,602 $73,011 $365,052 Tier 4 Willful neglect (not corrected within 30 days $73,011 $2,…
Metrics
financial
$14.6K
Financial Impact
Annual Penalty Limit  Annual Penalty Limit  Minimum Penalty per Violation Maximum Penalty per Violation Annual Penalty Cap Tier 1 Lack of Knowledge $145 $36,505.50 $36,505.50 Tier 2 Reasonable Cause  $1,461 $73,011 $146,053 Tier 3 Willful Neglect $14,602 $73,011 $365,052 Tier 4 Willful neglect (not corrected within 30 days $73,011 $2,…
A violation due to willful neglect, which is corrected within thirty days, will attract a fine of between $14,602 and $73,011.
Metrics
financial
$365K
Financial Impact
Annual Penalty Limit  Annual Penalty Limit  Minimum Penalty per Violation Maximum Penalty per Violation Annual Penalty Cap Tier 1 Lack of Knowledge $145 $36,505.50 $36,505.50 Tier 2 Reasonable Cause  $1,461 $73,011 $146,053 Tier 3 Willful Neglect $14,602 $73,011 $365,052 Tier 4 Willful neglect (not corrected within 30 days $73,011 $2,…
Metrics
financial
$2.2M
Financial Impact
Annual Penalty Limit  Annual Penalty Limit  Minimum Penalty per Violation Maximum Penalty per Violation Annual Penalty Cap Tier 1 Lack of Knowledge $145 $36,505.50 $36,505.50 Tier 2 Reasonable Cause  $1,461 $73,011 $146,053 Tier 3 Willful Neglect $14,602 $73,011 $365,052 Tier 4 Willful neglect (not corrected within 30 days $73,011 $2,…
A violation due to willful neglect, which is not corrected within thirty days, will attract a fine of between $73,011 and $2,190,294.
The maximum financial penalty for willful neglect of the HIPAA Rules is $2,190,294 per violation category, per year.
Metrics
financial
$3.5M
Settlement
Fresenius Medical Care North America settled the case for $3,500,000.
The previous record was the $3.5 million settlement with Triple S Management Corporation, agreed in November 2015.
Metrics
infrastructure
22
Hipaa Violation Cases
In 2022, OCR resolved 22 HIPAA violation cases with financial penalties, and while there was a dip in enforcement actions in 2023 to just 13 penalties, they rose to 16 in 2024 and 21 in 2025.
Metrics
infrastructure
50
Hipaa Violation Cases
As of January 2026, OCR has settled or imposed civil monetary penalties in more than 50 HIPAA violation cases under this compliance initiative.
Metrics
financial
$100K
Financial Impact
Under the Notice of Enforcement Discretion, the maximum annual penalty for a violation will be capped at $25,000 for Tier 1, $100,000 for Tier 2, and $250,000 for Tier 3, plus annual inflation increases.
West Caldwell Care Center accepted that the records were not provided within 30 days, but submitted evidence of mitigating factors; however, they were rejected by OCR, which imposed a civil monetary penalty of $100,000.
Boston Medical Center agreed to settle the alleged HIPAA violations with OCR for $100,000.
FileFax agreed to settle the alleged HIPAA violations for $100,000.
The clinic failed to respond to an offer to informally settle the alleged HIPAA Right of Access violation, resulting in OCR imposing a $100,000 civil monetary penalty.
The case was settled for $100,000.
OCR imposed a civil monetary penalty of $100,000.
Dr. Glazer did not cooperate with OCR during the investigation, resulting in OCR imposing a civil monetary penalty of $100,000 for the HIPAA Right of Access violation.
OCR determined there had been a risk analysis failure, and the case was settled for $100,000.
Metrics
financial
$250K
Financial Impact
Under the Notice of Enforcement Discretion, the maximum annual penalty for a violation will be capped at $25,000 for Tier 1, $100,000 for Tier 2, and $250,000 for Tier 3, plus annual inflation increases.
The case was settled with a $250,000 financial penalty.
The case was settled for $250,000.
The investigation was settled, and a penalty of $250,000 was paid to resolve the alleged HIPAA violations.
OCR proposed a $250,000 financial penalty; however, the proposed fine was contested, and a hearing was requested with an Administrative Law Judge (ALJ).
QCA Health Plan has agreed to settle the HIPAA violations with OCR for $250,000.
Metrics
data_breach
10,023
Members
Hackers had access to its network from November 24, 2021, to November 26, 2021, including servers containing the ePHI of 10,023 members of its employee-sponsored health and wellness plan.
Metrics
financial
$103K
Fine / Penalty
The case was settled, and Top of the World Ranch Treatment Center agreed to pay a $103,000 financial penalty to settle the alleged violation and adopt a corrective action plan to address all areas of noncompliance.
Metrics
financial
$600K
Fine / Penalty
The alleged violations were settled, and PIH Health paid a $600,000 financial penalty.
Metrics
financial
$350K
Fine / Penalty
The alleged violation was settled, and Northeast Radiology agreed to pay a $350,000 financial penalty.
The case was settled for $350,000.
Metrics
financial
$60K
Fine / Penalty
OCR determined that this was a violation of the HIPAA Right of Access; however Memorial Health System disagreed with the determination, as a copy of the EEG tracing had been provided to the patient on a previous occasion; however, the case was settled to avoid the time and cost of litigation and Memorial Health System paid a $60,000 penalty.
Metrics
data_breach
6,666
Members
The investigation also revealed that Children’s Hospital Colorado failed to provide HIPAA Privacy Rule training to 6,666 members of the workforce, including 3,495 nursing students, and a HIPAA-compliant risk analysis had not been conducted until February 5, 2021.
Metrics
financial
$548K
Fine / Penalty
OCR imposed a civil monetary penalty of $548,265 to resolve the alleged HIPAA Privacy and Security Rule violations.
Metrics
financial
$115K
Fine / Penalty
OCR determined that there had been a violation of the HIPAA Right of Access and provided American Medical Response with the opportunity to settle; however, American Medical Response chose not to, resulting in a civil monetary penalty being imposed for $115,200 to resolve the HIPAA violation.
Metrics
financial
$20K
Fine / Penalty
Health Specialists of Central Florida Inc. settled the case with OCR and paid a $20,000 penalty.
OCR settled the case for $20,000.
Metrics
financial
$160K
Settlement
The HIPAA Right of Access violation was settled with OCR for $160,000.
The Case was settled for $160,000.
The case was settled for $160,000.
Metrics
financial
$80K
Fine / Penalty
CHMC settled the HIPAA Right of Access case with OCR and paid an $80,000 penalty.
The HIPAA violation case was settled, and Elgon Information Systems paid an $80,000 penalty.
The case was settled for $80,000.
OCR determined there had been a HIPAA Right of Access failure, and UnitedHealthcare was fined $80,000.
The practice settled the case with OCR for $80,000.
Metrics
infrastructure
2,020
Journal Hipaa Violation Cases
Your Privacy Respected HIPAA Violation Cases 2020 Premera Blue Cross Mountlake Terrace, WA-based Premera Blue Cross is the largest health plan in the Pacific Northwest.
Metrics
financial
$3M
Financial Impact
Your Privacy Respected HIPAA Violation Cases 2018 Cottage Health – Exposure of ePHI Over the Internet OCR agreed to settle multiple alleged HIPAA violations with Cottage Health for $3,000,000.
Solara settled the alleged violations and paid a $3,000,000 financial penalty.
The case was settled for $3 million.
Metrics
financial
$125K
Settlement
Allergy Associates of Hartford paid OCR $125,000 to settle the alleged HIPAA violations.
Metrics
financial
$384K
Financial Impact
Brigham and Women’s Hospital agreed to settle the alleged HIPAA violations with OCR for $384,000.
Metrics
financial
$515K
Financial Impact
Massachusetts General Hospital agreed to settle the alleged HIPAA violations with OCR for $515,000.
Metrics
financial
$4.3M
Fine / Penalty
University of Texas MD Anderson Cancer Center was ordered to pay a civil monetary penalty of $4,348,000.
Metrics
financial
$2.4M
Payment
Memorial Hermann Health System has agreed to pay OCR $2,400,000.
Metrics
financial
$31K
Payment
The Center for Children’s Digestive Health (CCDH); a small 7-center pediatric subspecialty practice based in Park Ridge, Illinois, has agreed to pay OCR $31,000 to resolve potential HIPAA violations.
Metrics
financial
$400K
Payment
Metro Community Provider Network (MCPN) has agreed to pay OCR $400,000 and adopt a robust corrective action plan to resolve all HIPAA compliance issues identified during the OCR investigation.
CNE is required to pay a financial penalty of $400,000 and must adopt a comprehensive Corrective Action Plan (CAP) to address various areas of HIPAA non-compliance.
A settlement of $400,000 was agreed upon with OCR to resolve the HIPAA violations .
Metrics
financial
$5.5M
Settlement
Memorial Healthcare Systems has paid the penalty for non-compliance with HIPAA Rules, and in addition to the $5.5 million settlement, a robust corrective action plan must be adopted to address all areas of non-compliance.
Metrics
financial
$2.2M
Settlement
MAPFRE has agreed to a $2,200,000 settlement with OCR.
Metrics
financial
$2.1M
Payment
St. Joseph Health has agreed to pay OCR $2,140,500.
Metrics
financial
$5.5M
Settlement
Advocate Health Care Network will pay a record $5.55 million to settle multiple potential violations of the Health Insurance Portability and Accountability Act.
Metrics
financial
$650K
Fine / Penalty
CHCS will also pay a financial penalty of $650,000.
Metrics
financial
$240K
Payment
Lincare Inc. is required to pay $239,800 for violations of the HIPAA Privacy Rule, which were discovered during the investigation of a complaint about a breach of 278 patient records.
Metrics
data_breach
278
Patient Records
Lincare Inc. is required to pay $239,800 for violations of the HIPAA Privacy Rule, which were discovered during the investigation of a complaint about a breach of 278 patient records.
Metrics
financial
$850K
Settlement
Lahey Hospital and Medical Center agreed to pay $850,000 to settle the case without admission of liability.
The case was settled for $850,000.
Metrics
financial
$150K
Settlement
ACMHS has agreed to settle the case with OCR for $150,000.
A settlement of $150,000 has been reached with OCR.
Metrics
financial
$800K
Settlement
Parkview Health System, Inc. – Failure to Safeguard PHI Parkview Healthcare System has agreed to pay an $800,000 settlement for a violation of the HIPAA Privacy Rule.
The case was settled with an $800,000 financial penalty.
The case was settled, and BayCare Health paid an $800,000 financial penalty.
Metrics
financial
$4.8M
Fine / Penalty
New York and Presbyterian Hospital (NYP) and Columbia University (CU) will jointly pay a penalty of $4,800,000.
Metrics
financial
$36.5K
Fine / Penalty
A violation of HIPAA attributable to ignorance of the HIPAA Rules can attract a fine of $145 – $36,505.50.
Metrics
financial
$140K
Fine / Penalty
The case was resolved with a $140,000 financial penalty.
Metrics
financial
$700K
Fine / Penalty
The case was settled with a $700,000 financial penalty and a corrective action plan to resolve the areas of noncompliance.
Metrics
financial
$50K
Fine / Penalty
The case was settled with a $50,000 financial penalty and a corrective action plan.
OCR settled the case for $50,000.
The failure to cooperate with the investigation and respond to an administrative subpoena resulted in a civil monetary penalty of $50,000.
Metrics
financial
$552K
Fine / Penalty
The case was settled with a $552,250 financial penalty and a corrective action plan to address the areas of noncompliance.
Metrics
financial
$450K
Fine / Penalty
The alleged HIPAA violations were resolved with a $450,000 financial penalty and the adoption of a corrective action plan.
Metrics
financial
$320K
Fine / Penalty
The case was resolved with a $320,000 financial penalty and a corrective action plan to address the noncompliance issues identified by OCR.
Metrics
financial
$375K
Fine / Penalty
The case was resolved with a $375,000 financial penalty and a corrective action plan to address the noncompliance issues identified by OCR.
Metrics
financial
$225K
Fine / Penalty
The case was resolved with a $225,000 financial penalty and a corrective action plan to address the noncompliance issues identified by OCR.
Deer Oaks agreed to pay a $225,000 financial penalty.
Metrics
financial
$245K
Fine / Penalty
The case was resolved with a $245,000 financial penalty and a corrective action plan to address the noncompliance issues identified by OCR.
Metrics
financial
$10K
Fine / Penalty
OCR settled the alleged violations, and MMG Fusion agreed to pay a $10,000 financial penalty.
The HIPAA violation case was settled with a $10,000 penalty.
The HIPAA Right of Access violation was settled with OCR for $10,000.
The case was settled for $10,000.
The impermissible disclosures of PHI resulted in a $10,000 settlement.
Metrics
financial
$112K
Settlement
The proposed financial penalty was contested, but a $112,500 settlement was ultimately agreed upon.
Metrics
financial
$182K
Fine / Penalty
The alleged HIPAA violations were settled with a $182,000 financial penalty and a corrective action plan.
Metrics
financial
$175K
Fine / Penalty
The case was settled with a $175,000 financial penalty and a corrective action plan.
Metrics
financial
$75K
Fine / Penalty
The case was settled with a $75,000 financial penalty.
The case was settled for $75,000.
The HIPAA Right of Access violation was settled with OR for $75,000.
Metrics
financial
$5K
Payment
A settlement was agreed, and Vision Upright MRI agreed to pay $5,000 to resolve the alleged violations.
OCR settled the case for $5,000.
The HIPAA Right of Access violation was settled with OCR for $5,000.
Metrics
financial
$228K
Fine / Penalty
A settlement was agreed upon that included a $227,816 financial penalty.
Metrics
financial
$200K
Fine / Penalty
OCR gave the university the opportunity to settle the case informally, but when a settlement could not be agreed, OCR proceeded to impose a civil monetary penalty of $200,000.
The case was settled for $200,000.
Metrics
financial
$338K
Fine / Penalty
USR Holdings settled the alleged violations and paid a $337,750 penalty.
Metrics
financial
$90K
Settlement
The HIPAA violation case was settled for $90,000.
The alleged violation was settled for $90,000.
Metrics
financial
$1.4M
Fine / Penalty
The multi-state action included a $1.4 million penalty.
Metrics
financial
$1.2M
Fine / Penalty
OCR imposed a civil monetary penalty of $1,190,000 to resolve the alleged violations.
Metrics
financial
$35.6K
Settlement
The case was settled for $35,581.
Metrics
financial
$25
Payment
The practice claimed the complainant would not pay a $25 administrative fee for mailing the records (certified mail) and that the request was denied because the practice believed she would use the information to commit insurance fraud.
Metrics
financial
$70K
Fine / Penalty
A civil monetary penalty of $70,000 was imposed for failing to provide timely access to medical records, in violation of the HIPAA Right of Access.
The ALJ upheld OCR’s determination but reduced the financial penalty to $70,000.
The HIPAA Right of Access violation was settled with OCR for $70,000.
The case was settled for $70,000.
Metrics
financial
$240K
Fine / Penalty
OCR imposed a civil monetary penalty of $240,000 to resolve the alleged violations.
The case was settled with OCR for $240,000.
OCR settled the case for $240,000.
Metrics
data_breach
2,910,000
Files
The hackers gained access to 291,0000 files containing patient data.
Metrics
financial
$950K
Settlement
OCR agreed to settle the alleged violations for $950,000.
Metrics
financial
$35K
Settlement
OCR then proposed a $35,000 settlement on the basis that the penalty was not further contested.
Metrics
financial
$40K
Fine / Penalty
Green Ridge Behavioral Health settled the alleged violations with no admission of wrongdoing and paid a $40,000 penalty.
Metrics
financial
$4.8M
Fine / Penalty
Montefiore Medical Center settled the investigation and paid a $4,750,000 penalty.
Metrics
financial
$500K
Settlement
The case was settled with a $500,000 settlement and a corrective action plan.
A settlement of $500,000 was agreed upon to resolve the alleged HIPAA violations.
Metrics
financial
$480K
Settlement
OCR settled the alleged HIPAA violations for $480,000.
Metrics
financial
$1.3M
Settlement
The case was settled for $1,300,000.
Metrics
data_breach
419
Medical Records
OCR investigated a report of snooping on 419 medical records by 23 security guards in the emergency department.
Metrics
financial
$30K
Settlement
The case was settled for $30,000.
The case was settled with OCR for $30,000.
OCR settled the case for $30,000.
After being notified by OCR about a proposed fine of $105,000, Dr. Brockley requested a hearing with an Administrative Law Judge, but settled out of court and agreed to a fine of $30,000.
The HIPAA Right of Access violation was settled with OCR for $30,000.
Metrics
financial
$15K
Settlement
The case was settled for $15,000.
Metrics
financial
$1.2M
Settlement
The case was settled for $1,250,000.
Metrics
financial
$16.5K
Fine / Penalty
The diagnostic laboratory settled the case with OCR and paid a $16,500 financial penalty.
Metrics
financial
£23K
Fine / Penalty
The case was settled with OCR, and a £23,000 financial penalty was imposed.
Metrics
financial
$301K
Settlement
The case was settled with OCR for $300,640.
Metrics
financial
$65K
Settlement
OCR settled the case for $65,000.
The HIPAA Right of Access violation was settled with OCR for $65,000.
The case was settled for $65,000.
Metrics
financial
$55K
Settlement
OCR settled the case for $55,000.
Metrics
financial
$22.5K
Settlement
OCR settled the case for $22,500.
Metrics
financial
$3.5K
Settlement
OCR settled the case for $3,500.
The case was settled for $3,500.
Metrics
financial
$105K
Fine / Penalty
After being notified by OCR about a proposed fine of $105,000, Dr. Brockley requested a hearing with an Administrative Law Judge, but settled out of court and agreed to a fine of $30,000.
Metrics
financial
$28K
Settlement
The case was settled, and a financial penalty of $28,000 was paid.
Metrics
financial
$62.5K
Settlement
The case was settled for $62,500.
Metrics
financial
$32.1K
Settlement
The HIPAA Right of Access violation was settled with OCR for $32,150.
Metrics
financial
$5.1M
Settlement
The case was settled for $5,100,000.
Metrics
financial
$6.8M
Settlement
The case was settled for $6,850,000.
Metrics
financial
$2.3M
Settlement
The case was settled for $2,300,000.
Metrics
financial
$36K
Settlement
The case was settled for $36,000.
Metrics
financial
$202K
Settlement
The case was settled for $202,400.
Metrics
financial
$1M
Settlement
The case was settled for $1,000,000.
Metrics
financial
$38K
Settlement
The case was settled for $38,000.
Metrics
financial
$1M
Settlement
The case was settled for $1,040,000.
Metrics
financial
$85K
Settlement
A settlement of $85,000 was agreed upon with OCR to resolve the HIPAA violation.
A settlement of $85,000 was agreed upon to resolve the violation.
Metrics
financial
$2.2M
Settlement
The case was settled for $2.175 million.
Metrics
financial
$900K
Fine / Penalty
MIE also settled a multi-state action with state attorneys general and paid a penalty of $900,000.
Metrics
financial
$16M
Settlement
Anthem agreed to a record-breaking settlement of $16,000,000 to resolve the case.
Metrics
data_breach
2,150
Patient Records
OCR determined there had been a failure to protect patient information, which resulted in an impermissible disclosure of 2,150 patient records.
Metrics
financial
$387K
Payment
St. Luke’s-Roosevelt Hospital Center Inc. has paid OCR $387,200 to resolve potential HIPAA violations discovered during an OCR investigation of a complaint about an impermissible disclosure of PHI.
Metrics
financial
$2.7M
Settlement
A penalty of $2.7 million will be paid by OHSU to settle alleged HIPAA violations without admission of liability.
Metrics
financial
$1.6M
Settlement
North Memorial has agreed to pay $1,550,000 to OCR to settle the HIPAA violation charges.
Metrics
data_breach
8,000
Patient Records
The doctor was retiring and received a delivery of 71 boxes of medical files containing up to 8,000 patient records; however, the delivery was made, and the boxes were left on the doctor’s driveway while he was out of the house.
Metrics
financial
$1.7M
Payment
Concentra has agreed to pay OCR $1,725,220 to resolve the case.
Metrics
financial
$215K
Payment
Skagit County agreed to pay OCR $215,000 following the exposure of the data of seven individuals.
Metrics
financial
$1.7M
Settlement
A settlement of $1,700,000 has been agreed upon with OCR to resolve the HIPAA violations that contributed to the cause of the breach.
Metrics
financial
$115M
Settlement
More than 100 private class action lawsuits were filed against Anthem, the ultimately consolidated case being settled for $115 million.
Intelligence Sources
HIPAA Journal 2026-10-30