HIPAA Violation Settlement: Maryland Firm Fined for Unreported Breach Impacting 15 Million The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) has resolved its second HIPAA enforcement action of 2024, securing a settlement with MMG Fusion LLC, a Maryland-based software provider for oral healthcare practices. The company agreed to pay a $10,000 penalty and implement a corrective action plan following an unreported data breach that exposed the protected health information (PHI) of 15 million individuals. The breach occurred on December 21, 2020, when an unauthorized actor infiltrated MMG’s network, accessing and exfiltrating sensitive data including names, contact details, dates of birth, and medical appointment records. The stolen information was later posted on the dark web. Despite the scale of the incident, MMG failed to report the breach to OCR or notify affected healthcare providers, allowing it to go undetected until a complaint prompted an investigation in January 2023. OCR’s probe revealed multiple HIPAA violations, including: - Failure to conduct a required risk assessment to identify vulnerabilities in electronic PHI (ePHI) security. - Non-compliance with the HIPAA Privacy Rule, which restricts unauthorized use or disclosure of PHI. - Violation of the Breach Notification Rule, as MMG did not alert affected covered entities or individuals. Under the settlement, MMG must: - Perform a comprehensive risk analysis and develop an enterprise-wide risk management plan. - Establish and distribute HIPAA-compliant policies and procedures. - Provide workforce training and submit materials to OCR for review. - Compile a list of all affected clients and, once OCR approves the risk assessment, notify impacted covered entities and individuals. OCR Director Paula M. Stannard emphasized the importance of timely breach reporting, noting that business associates must notify covered entities within 60 days of discovery to ensure compliance with notification requirements. The case highlights OCR’s focus on risk analysis failures and breach notification lapses, which remain leading causes of HIPAA penalties.