I recently asked #HHS #OCR how any personnel and regional cuts would affect their investigation of breaches of the #HIPAA #SecurityRule and #Notification Rule.

They didn't exactly answer my question as to how many investigators have been laid off, but they did outline their priorities for 2026.

You can read their response to my inquiries in my new post at:

https://databreaches.net/2026/01/15/hhs-ocr-comments-on-its-2026-priorities/

#databreach #healthsec #cybersecurity #ransomware #hacking #risk

Methodist Homes of Alabama and Northwest Florida is notifying residents and employees of its second data breach in seven months.

I wonder what #HHSOCR will do when they investigate.

https://databreaches.net/2026/01/08/methodist-homes-of-alabama-and-northwest-florida-is-notifying-residents-and-employees-of-its-second-data-breach-in-seven-months/

#HIPAA #SecurityRule #RiskAssessment #cybersecurity #healthsec

The second part of my interview with Rachel Seeger of North Country Communications is now online. If you know any HIPAA-regulated SMBs struggling with compliance issues or seeking great information and advice, point them to Rachel's consultancy.

HIPAA Compliance and Breach Communications: Helpful Tips for SMBs:
https://databreaches.net/2026/01/06/hipaa-compliance-and-breach-communications-helpful-tips-for-smbs/

or download a copy od the interview:
https://databreaches.net/wp-content/uploads/HIPAA-Compliance-and-Breach-Communications.pdf

Direct link to North Country Communications: https://northcountrycommunications.com/

#HIPAA #compliance #BreachNotification #PrivacyRule #SecurityRule #BusinessAssociates

NEW: Six months after discovering an attack, Northwest Radiologists notifies almost 350,000 Washington State residents

https://databreaches.net/2025/08/01/six-months-after-discovering-an-attack-northwest-radiologists-notifies-almost-350000-washington-state-residents/

#databreach #incident_management #healthsec #HIPAA #SecurityRule #PrivacyRule

Jackson Health System has disclosed another insider-wrongdoing breach. This one affected about 2000 patients. The employee's motivation was reportedly related to boosting their personal healthcare business.

In their notice, JHS tries to portray themself as a victim. That didn't go over too well with me, as this is not the first time they have had a long-running insider wrongdoing breach.

In 2019, they settled HHS OCR charges after three breaches -- one of which involved insider wrongdoing over 5 years that affected 24k patients. There was no corrective action plan as part of the settlement. Perhaps there should have been?

Read more:
https://databreaches.net/2025/06/07/data-breach-of-patient-info-ends-in-firing-of-miami-hospital-employee/

#databreach #healthsec #insiderthreat #HIPAA #SecurityRule #insiderwrongdoing

HHS OCR Settles HIPAA Security Rule Investigation of BayCare Health System for $800k and Corrective Action Plan

[It's an insider wrongdoing case from 2018 that we never heard about at the time]

https://databreaches.net/2025/05/29/hhs-ocr-settles-hipaa-security-rule-investigation-baycare-health-system-for-800k-and-corrective-action-plan/

#HIPAA #SecurityRule #InsiderThreat #HHS #HHSOCR #BayCare

No need to hack when it’s leaking: Atrium Health edition:
https://databreaches.net/2025/04/24/no-need-to-hack-when-its-leaking-atrium-health-edition/

#healthsec #leak #HIPAA #SecurityRule #databreach #cybersecurity

16 months after they experienced a ransomware attack, Dameron Hospital notifies those affected:

https://databreaches.net/2025/04/04/16-months-after-they-experienced-a-ransomware-attack-dameron-hospital-notifies-those-affected/

#HIPAA #ransomware #databreach #incidentresponse #SecurityRule #notifications #HHS

Great thanks to @adamshostack for getting people together to think about this issue and to make recommendations to #HHS under the #HIPAA Security Rule.

https://shostack.org/blog/security-researcher-comment-on-hipaa-security-rules/

Direct link to comments to HHS by @adamshostack, @dykstra, Fred Jennings, Chloé Messdaghi, and me:

https://downloads.regulations.gov/HHS-OCR-2024-0020-4673/attachment_1.pdf

#GoodFaith #SecurityRule #ResponsibleDisclosure #VDP

So... apart from the fact that I don't think they should have dropped charges against this doctor, is HHS going to investigate why the hospital gave access to patient data to a former employee/resident who no longer worked there and was never these patients' doctor?

US Justice Department drops case against Texas doctor charged with leaking transgender care data:
https://www.wfaa.com/article/news/local/us-justice-department-drops-case-against-doctor-charged-with-leaking-transgender-care-data/287-3e8a394d-41fb-41bf-bf72-fd012b87851b

#HealthSec #HIPAA #SecurityRule #databreach #privacy #confidentiality #insiderthreat #HHS #HHSOCR

@froge I agree. If this is just the beginning of a new campaign that addresses timely notification too. They have announced the campaign on risk assessment already and have already announced a few settlements over that. But there's been no formal announcement or press release about any campaign specifically targeting timely notification.

I haven't finished up our 2024 gap analyses between discovery of breaches and notifications, but too many do not or cannot comply with the regulation. And then there all the entities that don't even report their breaches at all, and I wonder how we will get HHS OCR to address that unless I send them a massive watchdog complaint that lists about 150 regulated entities that didn't disclose breaches this past year when it appears that they did have reportable breaches.

#HIPAA #Notification #HITECH #SecurityRule #Transparency

Anyone else think that the HHS OCR monetary penalty imposed on Solara Medical was too steep? $3M is one of the steepest monetary penalties HHS OCR has imposed.

I'm glad to see enforcement of the timely notification requirement, but so many entities have blown the risk assessment requirement and the 60 day notification regulations so why is Solara being hit with such a stiff penalty?

https://databreaches.net/2025/01/14/hhs-office-for-civil-rights-settles-hipaa-phishing-cybersecurity-investigation-with-solara-medical-supplies-llc-for-3000000/

#HIPAA #SecurityRule #enforcement #databreach #risk_assessment #notification

Westend Dental agrees to pay Indiana $350K and to implement a corrective action plan to settle charges of multiple HIPAA violations.

This is one of THE WORST incident responses I have ever read and I've read a lot of bad ones over the years. But it's not just an incident response disaster. They were routinely violating HIPAA privacy and security rules.

Kudos to the state of Indiana for going after the dental practice and investigating to find out all the problems.

Don't ask me what HHS OCR did, because I don't think they were ever even told about this 2020 ransomware attack.

Read more here, where you will also find the court filings I've uploaded so you can read how bad this one was:

https://databreaches.net/2024/12/31/westend-dental-agrees-to-pay-indiana-350k-and-to-implement-corrective-action-plan-to-settle-charges-of-multiple-hipaa-violations/

#ransomware #compliance #HIPAA #healthsec #encryption #backup #PrivacyRule #SecurityRule #ransparency #disclosure #notification

@zackwhittaker @jgreig

HHS OCR settles charges that Inmediata Health Group was exposing patient protected health info online for 3 years due to a webpage error.

Inmediata previously settled a class action lawsuit stemming from the 2016-2019 leak. They also settled a lawsuit by 33 state attorneys general last year. The HHS OCR settlement was for $250k monetary penalty; no corrective action plan was needed since the states' settlement already included a corrective action plan.

Direct link to the resolution agreement:

https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/inmediata-health-group-ra-cap/index.html

Press release: https://www.hhs.gov/about/news/2024/12/10/hhs-office-civil-rights-settles-health-care-clearinghouse-inmediata-health-group-hipaa-impermissible-disclosure.html

Inmediata even had trouble with their incident response, as noted on my blog at the time: https://databreaches.net/2019/04/30/in-the-process-of-notifying-patients-of-a-web-exposure-breach-inmediata-experiences-a-mail-exposure-breach/

#HIPAA #HHSOCR #SecurityRule #Exposure #Databreach #dataleak #healthsec #Infosecurity

#HHSOCR announced a $1.19M monetary penalty for Gulf Coast Pain Consultants stemming from a 2019 #databreach. Now we find out that the "third party" that accessed the data was a former contractor.

The covered entity got hit with a fine for failure to:

• conduct an accurate and thorough risk analysis to determine the potential risks and vulnerabilities to ePHI in its systems;
• implement procedures to regularly review records of activity in information systems;
• implement procedures to terminate former workforce members’ access to ePHI; and
• implement procedures for establishing and modifying workforce members’ access to information systems.

https://databreaches.net/2024/12/03/hhs-office-for-civil-rights-imposes-a-1-19-million-penalty-against-gulf-coast-pain-consultants-for-hipaa-security-rule-violations/

#HIPAA #HealthSec #SecurityRule #InsiderThreat #Access

An announcement from HHS OCR:

"In recognition of National Cybersecurity Awareness Month, OCR has produced a new video this October to provide awareness and education for organizations covered under the HIPAA Rules on ransomware and how compliance with the HIPAA Security Rule can help such organizations combat ransomware.

This video updates the health care industry on the ransomware trends OCR sees in its cybersecurity investigations, OCR guidance and resources, best practices and practical advice on how HIPAA compliance can help HIPAA regulated entities prevent, detect, respond to, and recover from ransomware attacks. Topics include:

• OCR breach and ransomware trend analysis
• Review of prior OCR ransomware guidance and materials
• Analysis of the ransomware attack chain
• Explore how Security Rule compliance can combat ransomware

The video presentation may be found on OCR’s YouTube channel at: https://www.youtube.com/watch?v=nBKUlAy1OFA

#HIPAA #HHS #OCR #ransomware #SecurityRule #HealthSec

In August 2023, El Centro Del Barrio ("CentroMed") reported a breach that affected 350,000 patients. Now they have reported a second #databreach. This one reportedly affected 400,000 patients.

The first breach was claimed by Karakurt, who does not seem to have ever leaked the data they claimed to have acquired. The second breach hasn't been claimed by any group -- at least, not yet.

So... will about 350,000 patients find their data has been stolen a second time in a year?

Not a good look for #CentroMed

https://databreaches.net/2024/05/21/tx-centromed-discloses-a-second-data-breach-within-one-year/

#HIPAA #SecurityRule #HealthSec #ransomware #extortion #ransom

HHS’ Office for Civil Rights Settles Malicious Insider Cybersecurity Investigation for $4.75 Million:

https://www.hhs.gov/about/news/2024/02/06/hhs-office-civil-rights-settles-malicious-insider-cybersecurity-investigation.html

Another #HIPAA #SecurityRule #enforcement action but this was from an #insider wrongdoing #databreach that police notified the center about in 2015. The theft occurred in 2013. Why is #HHSOCR first settling this NOW?

#IDtheft #fraud

Was a recent OCR settlement fair? Maybe, but maybe not.

Following up on a great piece by Theresa Defino, I took another look at the recent settlement HHS OCR announced with Doctors' Management Service, and now I think that maybe OCR was too heavy-handed in their enforcement. See what you think:

https://www.databreaches.net/was-a-recent-ocr-settlement-fair-maybe-but-maybe-not/

#HIPAA #SecurityRule #databreach #ransomware #infosec #healthsec #cybersecurity #enforcement #transparency

Another plastic surgery practice appears to have been hit -- this time by Hunters International:

https://www.databreaches.net/another-plastic-surgery-practice-appears-to-have-been-hit-this-time-by-hunters-international/

@brett @briankrebs @campuscodi @vxunderground @lawrenceabrams

#databreach #HealthSec #cybersecurity #extortion #HIPAA #SecurityRule #PrivacyRule #FTC