Loading story…
The U.S. Department of Health and Human Services Office for Civil Rights announced HIPAA enforcement settlements against Assured Imaging Affiliated Covered Entities, Axia Women’s Health, Star Group, L.P. Health Benefits Plan, and Consociate Health after ransomware-related breaches exposed the electronic protected health information of about 427,000 individuals. OCR said the cases shared the same core failure: deficient or nonexistent security risk analysis under the HIPAA Security Rule, and each organization agreed to a corrective action plan with two years of federal monitoring.
The settlements totaled about $1.7 million across the four cases, with reports also citing $1,165,000 in penalties as part of the enforcement actions. OCR said a HIPAA gap assessment is not a substitute for a formal risk analysis and warned that unresolved known risks can increase liability after a breach. Regulators and experts said covered entities should inventory all systems holding ePHI, assess threats and vulnerabilities, assign and track risk remediation, and strengthen controls such as access management, audit logging, encryption, incident response planning, and workforce training.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
The HHS Office for Civil Rights announced enforcement settlements against Assured Imaging Affiliated Covered Entities, Axia Women’s Health, Star Group, L.P. Health Benefits Plan, and Consociate Health after ransomware incidents exposed the ePHI of about 427,000 individuals. OCR said the common issue across the cases was deficient or missing HIPAA security risk analysis, and each settlement included a corrective action plan with two years of monitoring.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
hipaajournal.com
Open sourcegovinfosecurity.com
Open sourcebankinfosecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (**OCR**) reached a **$103,000** settlement with Illinois-based substance use disorder provider **Top of the World Ranch Treatment Center** to resolve alleged noncompliance with the **HIPAA Security Rule** risk analysis requirement. OCR characterized the action as its first financial penalty of the year and part of its ongoing enforcement initiative focused on organizations that fail to conduct an *accurate and thorough* risk analysis to identify risks to the confidentiality, integrity, and availability of **electronic protected health information (ePHI)**. OCR opened the investigation after the provider reported a **March 2023** breach tied to a **phishing attack** that enabled unauthorized access to ePHI via a workforce member’s email account, with **1,980 patients** potentially affected. In addition to the monetary payment, the resolution requires a **two-year corrective action plan** including completion of a comprehensive risk analysis, implementation of a risk management plan, updated written HIPAA policies and procedures (Privacy, Security, and Breach Notification Rules), and annual workforce training; OCR cited broader sector trends of rising hacking-related breach reports as context for the risk-analysis enforcement focus.
Jun 29, 2026
Group Health Cooperative of South Central Wisconsin agreed to a $3.5 million settlement to resolve a class action lawsuit following a data breach that exposed the protected health information (PHI) of over 533,000 individuals. The breach, detected in January 2024, involved unauthorized access to sensitive data including names, Social Security numbers, and Medicare/Medicaid numbers. The settlement, which has received preliminary court approval, will compensate affected class members and was reached to avoid the costs and risks of continued litigation, with the defendant denying any wrongdoing. Separately, Concentra Inc. settled with the U.S. Department of Health and Human Services Office for Civil Rights (OCR) for $112,500 over a HIPAA Right of Access violation, after failing to provide a patient with timely access to their medical records despite multiple requests. This enforcement action is part of an ongoing OCR initiative targeting noncompliance with the HIPAA Privacy Rule's right of access provision. These cases highlight the significant financial and legal consequences for healthcare organizations that fail to adequately protect patient data or comply with HIPAA requirements.
Jul 12, 2026
The U.S. Department of Health and Human Services (HHS) **Office for Civil Rights (OCR)** announced a settlement with **MMG Fusion, LLC**, a Maryland-based software provider to oral healthcare organizations acting as a HIPAA business associate, over alleged violations of the **HIPAA Privacy, Security, and Breach Notification Rules** tied to an **unreported breach** impacting approximately **15 million individuals**. OCR’s investigation found that an unauthorized actor accessed MMG’s internal systems in **December 2020**, obtained protected health information (PHI)—including names, phone numbers, mailing and email addresses, dates of birth, and appointment dates/times—and that the data was **exfiltrated and later posted on the dark web**; OCR opened the case after receiving a complaint in early 2023 rather than a breach report from MMG. According to OCR’s findings, MMG Fusion allegedly failed to perform a comprehensive risk analysis prior to the incident and did not provide required breach notifications to affected covered entities. Under the resolution agreement, MMG agreed to a **corrective action plan** (with OCR monitoring for **three years**) and paid **$10,000**, with OCR noting MMG’s financial condition as a factor in the settlement amount. Separate HIPAA compliance guidance content on designated record sets is not part of the enforcement action and does not add incident-specific details.
Jun 29, 2026