Office for Civil Rights HIPAA enforcement actions, investigations, and compliance strategies
In February 2023, OCR settled with a healthcare provider for $1.3 million after finding systemic failures to comply with basic HIPAA laws — failures that
In 2023, OCR settled with Doctors' Management Services for $100,000 after a ransomware attack exposed the protected health information of over 206,000
When Cignet Health of Maryland refused to provide 41 patients access to their medical records, the Office for Civil Rights (OCR) imposed a $4.3
When OCR levied a $4.3 million settlement against MD Anderson Cancer Center in 2018 for unencrypted devices containing protected health information, the enforcement authority
In February 2024, OCR settled with a large health system for $480,000 after investigators found that the organization had failed to provide adequate HIPAA
In 2023, the Department of Health and Human Services Office of Inspector General (OIG) reported over $3.6 billion in expected recoveries from healthcare fraud
A behavioral health clinic in Connecticut received a $125,000 penalty from OCR after disclosing a spreadsheet of patient data that staff believed was "
Why a Single Patient Identifier Triggers Full HIPAA Protection In 2023, OCR settled with a New England dermatology practice for $300,640 after an investigation
In 2023, the Department of Justice recovered over $2.68 billion in healthcare fraud settlements and judgments — a significant portion tied to Anti-Kickback Statute (AKS)
In December 2023, OCR settled with a healthcare system for $480,000 after an investigation revealed workforce members had been emailing unencrypted patient information to
In 2023, OCR settled a case with a dental management company — not a dentist, not a hospital, but an administrative services firm — for $350,000
A nurse finishes a difficult shift and, over dinner with friends, recounts a dramatic case from the ER — the injuries, the treatment, the patient'
Join healthcare organizations that trust HIPAA Certify for their workforce training and compliance tracking.