Office for Civil Rights HIPAA enforcement actions, investigations, and compliance strategies
In 2022, OCR settled with a dental practice for $25,000 after an investigation revealed the organization had disclosed an entire patient medical record to
In 2023, OCR settled with a covered entity for over $100,000 after an investigation revealed that employees were routinely accessing patient records unrelated to
In February 2024, OCR settled with a New England dermatology practice for $300,640 after investigators found the organization had no policies implementing basic Privacy
In 2023, OCR settled with a dental practice for $350,000 after investigators discovered the organization had no written security policies, no risk analysis, and
In February 2023, OCR settled with a healthcare provider for $1.25 million after investigators found failures spanning all three HIPAA rules — inadequate safeguards for
In February 2023, OCR settled with Banner Health for $1.25 million after a breach affecting nearly 3 million individuals exposed failures across multiple HIPAA
In 2023, OCR investigated a mid-size hospital that suffered a breach traceable to a volunteer who accessed patient records without authorization. The hospital argued the
In February 2024, OCR announced a $4.75 million settlement with Montefiore Medical Center after a workforce member stole the protected health information of over
In 2023, OCR settled with a dental practice for $350,000 after an investigation revealed the organization had disclosed patient records without authorization — in part
In 2023, OCR settled with a major health plan for $1.3 million after an investigation revealed the plan had used enrollee protected health information
In 2023, OCR settled with a covered entity for over $1.2 million after an investigation revealed that workforce members routinely accessed full patient records
In 2022, CMS reported over $12.59 billion in payments from drug and device manufacturers to physicians and teaching hospitals through the Open Payments database
Join healthcare organizations that trust HIPAA Certify for their workforce training and compliance tracking.