EN PT-BR
← Voltar ao feed
low healthcare retail professional services

HHS OCR HIPAA Enforcement Tracker 2026: Ransomware and Phishing Breaches Drive Settlements Led by Lehigh Valley ($800K)

1 fonte(s) · 1 atualização(ões) · publicado 30/10/2026 19:17 · coletado há 1 hora

This HIPAA Journal reference page catalogs HIPAA violation cases resolved by the HHS Office for Civil Rights (OCR) through settlements and civil monetary penalties. OCR enforcement is rising, with 13 penalties in 2023, 16 in 2024 and 21 in 2025. OCR Director Paula M. Stannard confirmed that the Right of Access and risk analysis initiatives continue in 2026, and that risk management will be added. Many 2025-2026 cases stem from ransomware or phishing breaches where the entity had not conducted a compliant risk analysis.

Detalhes técnicos

  • Lehigh Valley Health Network: BlackCat ransomware breach affecting 248,359 individuals; data stolen and leaked, including patient images. Settled for $800,000.
  • Ambry Genetics: phishing incident affecting 225,370 individuals. Settled for $700,000 with a corrective action plan (CAP).
  • OSF Healthcare: ransomware attack on April 23, 2021, affecting 53,907 patients. Settled for $552,250.
  • Spencer Gifts: ransomware attack in November 2021 affecting 10,023 health plan members. Settled for $450,000.
  • Assured Imaging: ransomware attack affecting 244,813 individuals. Settled for $375,000.
  • Regional Women's Health Group: 37,989 individuals affected. Settled for $320,000.
  • Star Group: 9,316 individuals affected. Settled for $245,000.
  • Consociate Health: access gained via phishing about six months before ransomware was discovered; 136,539 individuals affected. Settled for $225,000.
  • MMG Fusion: data of about 15 million patients stolen and posted on the dark web; unreported breach. Settled for $10,000 because of the company's financial position.
  • Top of the World Ranch: phishing incident affecting 1,980 patients. Settled for $103,000.
  • BST & Co. CPAs: ransomware after a phishing email, up to 170,000 affected. Settled for $175,000.
  • Syracuse ASC: ransomware attack, 24,891 affected, with delayed notification. Settled for $250,000.
  • Common findings: no comprehensive risk analysis, insufficient activity monitoring, late breach notification, and missing access termination or unique user IDs.

Remediação

Conduct and regularly update an accurate, organization-wide risk analysis and implement risk management to reduce risks to an acceptable level. Monitor information system activity, terminate access promptly, assign unique user IDs, and issue breach notifications on time. Train the workforce and provide timely patient access to records. Penalty tiers run up to $2,190,294 per violation category per year for willful neglect.

Linha do tempo

  1. hipaajournal.com ↗ · pub. 30/10/2026 19:17 · coletado 02/11 10:01 primeiro registro

    HHS OCR HIPAA Enforcement Tracker 2026: Ransomware and Phishing Breaches Drive Settlements Led by Lehigh Valley ($800K)

    ler a análise desta fonte

    This HIPAA Journal reference page catalogs HIPAA violation cases resolved by the HHS Office for Civil Rights (OCR) through settlements and civil monetary penalties. OCR enforcement is rising, with 13 penalties in 2023, 16 in 2024 and 21 in 2025. OCR Director Paula M. Stannard confirmed that the Right of Access and risk analysis initiatives continue in 2026, and that risk management will be added. Many 2025-2026 cases stem from ransomware or phishing breaches where the entity had not conducted a compliant risk analysis.

    Technical Details

    • Lehigh Valley Health Network: BlackCat ransomware breach affecting 248,359 individuals; data stolen and leaked, including patient images. Settled for $800,000.
    • Ambry Genetics: phishing incident affecting 225,370 individuals. Settled for $700,000 with a corrective action plan (CAP).
    • OSF Healthcare: ransomware attack on April 23, 2021, affecting 53,907 patients. Settled for $552,250.
    • Spencer Gifts: ransomware attack in November 2021 affecting 10,023 health plan members. Settled for $450,000.
    • Assured Imaging: ransomware attack affecting 244,813 individuals. Settled for $375,000.
    • Regional Women's Health Group: 37,989 individuals affected. Settled for $320,000.
    • Star Group: 9,316 individuals affected. Settled for $245,000.
    • Consociate Health: access gained via phishing about six months before ransomware was discovered; 136,539 individuals affected. Settled for $225,000.
    • MMG Fusion: data of about 15 million patients stolen and posted on the dark web; unreported breach. Settled for $10,000 because of the company's financial position.
    • Top of the World Ranch: phishing incident affecting 1,980 patients. Settled for $103,000.
    • BST & Co. CPAs: ransomware after a phishing email, up to 170,000 affected. Settled for $175,000.
    • Syracuse ASC: ransomware attack, 24,891 affected, with delayed notification. Settled for $250,000.
    • Common findings: no comprehensive risk analysis, insufficient activity monitoring, late breach notification, and missing access termination or unique user IDs.

    Remediation

    Conduct and regularly update an accurate, organization-wide risk analysis and implement risk management to reduce risks to an acceptable level. Monitor information system activity, terminate access promptly, assign unique user IDs, and issue breach notifications on time. Train the workforce and provide timely patient access to records. Penalty tiers run up to $2,190,294 per violation category per year for willful neglect.