11 casos · pág. 1/1
The HHS Office for Civil Rights (OCR) can impose civil penalties of $14,602 to $2,190,294 per violation for knowingly violating HIPAA. These fall under Tier 3 and Tier 4 "willful neglect" violations, depending on whether the violation is corrected within 30 days. Penalty amounts are also influenced by prior compliance history, cooperation…
The HIPAA Journal explainer reviews how HHS Office for Civil Rights (OCR) and state attorneys general enforce HIPAA, and which penalty amounts apply in 2026. Most OCR actions end in settlements with a corrective action plan, while contested cases can end in a civil monetary penalty, which is higher than a settlement and carries no correct…
State attorneys general share HIPAA enforcement with the HHS Office for Civil Rights (OCR) under authority granted by the HITECH Act. The first action came in 2010, when the Connecticut AG settled with Health Net for $250,000. Enforcement peaked in 2023 with 16 actions, including a $49.5 million penalty against Blackbaud over a 5.5 millio…
The HIPAA Journal has updated its compilation of HHS OCR breach portal data (October 2009 to August 2026, data pulled October 10, 2026). It shows a record 772 large healthcare breaches (500+ individuals) in 2025, after a sharp rise between 2018 and 2021 driven by ransomware. From January to April 2026, 252 large breaches were reported, 9.…
The HIPAA Journal explainer sets out the HIPAA violation penalty framework in 2026. Civil monetary penalties range from $145 to $2,190,294 per violation, depending on culpability. Criminal penalties and state attorney general actions can apply as well. HHS confirmed in October 2026 that there will be no inflation adjustment in 2026, becau…
HHS confirmed in the Federal Register that it will not apply an annual inflation multiplier to HIPAA civil monetary penalties in 2026, so the 2025 penalty levels stay in force. The cause is the lengthy fall 2025 government shutdown, which stopped the Bureau of Labor Statistics (BLS) from producing the October 2025 CPI-U data needed to cal…
The U.S. Department of Health and Human Services (HHS) Office of the National Coordinator for Health IT (ONC) has sent letters of nonconformity to seven health IT companies suspected of information blocking in violation of the 21st Century Cures Act. The recipients have not been named while investigations are active. They will be named if…
Jefferson County Health Department (Hillsboro, Missouri) has agreed to a $2.25 million settlement of a consolidated class action over a 2022 data security incident. An unauthorized third party accessed its network between October 31 and November 15, 2022, and may have viewed or obtained personal and protected health information. The breac…
A $6,438,578.20 settlement has been agreed to resolve the "Other Labs Track" of consolidated litigation over the American Medical Collection Agency (AMCA) breach. The defendants are AMCA clients Sonic Healthcare U.S.A., Aurora Diagnostics LLC, Clinical Pathology Laboratories, Inc. and Austin Pathology Associates. AMCA, a subsidiary of Ret…
The 2026 Ponemon Healthcare Cybersecurity Report, commissioned by Proofpoint, finds that cyberattacks on healthcare organizations are rising, costing more and increasingly harming patient care. The survey covered 705 IT and security practitioners. 97% of organizations suffered at least one attack in the past 12 months, averaging 51 attack…
California has settled with 23andMe for $6 million over the 2023 credential-stuffing breach. The breach exposed personal and genetic data of about 6.9 million people, including 855,000 California residents. The settlement follows a July 2026 $18 million settlement with a coalition of 42 state attorneys general, which California did not jo…
