Office for Civil Rights HIPAA enforcement actions, investigations, and compliance strategies
A $4.3 Million Mistake Started with One Misunderstood Spreadsheet In 2016, the University of Texas MD Anderson Cancer Center lost an unencrypted laptop and
A therapist in Ohio logs into a video platform, greets her patient, and starts a session about suicidal ideation. The session is encrypted in transit
A front-desk employee at a cardiology clinic in Texas faxed a patient's billing statement to the wrong number. The document included a name,
A hospital in Louisiana lost $480,000 because a single employee snooped through a patient's medical record out of curiosity. Not a hacker.
I once watched a practice manager spend three hours searching for a "federally recognized HIPAA certification test" — convinced that HHS issued some kind
In 2018, a medical billing company called Advanced Care Hospitalists paid $500,000 to settle with HHS after a business associate they'd hired
A small dermatology practice in Connecticut thought they were HIPAA compliant because they had a privacy notice in the lobby and passwords on their computers.
A front-desk employee at a Florida clinic bills Medicare for physical therapy sessions that never happened. A physician upcodes patient visits — documenting complex evaluations when
A hospital employee in Texas once forwarded a patient's lab results to her personal Gmail account so she could "finish charting at
A $4.3 Million Fine Started with a Missing Definition In 2016, the University of Texas MD Anderson Cancer Center lost three unencrypted devices containing
The Hurricane That Exposed a Hospital's HIPAA Blind Spot In the aftermath of Hurricane Katrina, hospitals across the Gulf Coast scrambled to reunite
A receptionist at a cancer clinic in Florida forwarded a spreadsheet of 1,200 patient names, diagnoses, and Social Security numbers to her personal Gmail
Join healthcare organizations that trust HIPAA Certify for their workforce training and compliance tracking.