HHS Settles Four HIPAA Violations Tied to Ransomware Attacks, Totaling $1.17 Million The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) announced four settlements with HIPAA-covered entities over ransomware incidents investigated under the HIPAA Security Rule. The breaches, occurring between 2020 and 2021, collectively exposed the protected health information (PHI) of over 427,000 individuals. The entities paid a combined $1.17 million in fines, agreed to corrective action plans, and will undergo two years of OCR monitoring. The settlements highlight OCR’s ongoing focus on enforcing HIPAA’s risk analysis requirements, a priority since its first enforcement action under this initiative in October 2024. Notably, the breaches varied in scale ranging from 9,300 to 244,813 affected individuals demonstrating that OCR is targeting entities of all sizes for compliance failures. Key Incidents: - Assured Imaging (Arizona/California): A May 2020 PYSA ransomware attack encrypted its EMR system and potentially exfiltrated data, impacting 244,813 individuals. OCR found the company had never conducted a HIPAA-compliant risk analysis and failed to notify victims within 60 days. Assured paid $375,000 and agreed to corrective measures. - Regional Women’s Health Group (New Jersey): A December 2020 breach affecting 37,000 patients led to a $320,000 settlement after OCR determined the entity had not assessed risks to PHI. - Star Group, L.P. Health Benefits Plan (Connecticut): An October 2021 ransomware attack exposed 9,300 individuals. OCR found improper PHI disclosures and a lack of risk assessment, resulting in a $245,000 fine. - Consociate Health (Business Associate): A July 2020 phishing attack led to ransomware deployment six months later, compromising 136,500 individuals’ PHI. OCR cited inadequate risk analysis, leading to a $225,000 settlement. OCR Director Paula M. Stannard noted that hacking and ransomware remain the most common large breaches reported to the agency. The settlements bring OCR’s total ransomware-related investigations to 19, with 13 completed under its risk analysis initiative.