News
Medical Data Rx Breach: The Gentlemen/VYPR Ransomware Group Claims Attack on Michigan Healthcare IT Vendor; Class Action Investigation Launched · Data BreachMid Florida Dermatology & Plastic Surgery Discloses Breach Affecting 85,585 Patients; Kannarr Eye Care and Indiana University Health Also Report Incidents · Data BreachCentral Ohio Primary Care Physicians Discloses Vishing-Triggered Breach Affecting 1.4 Million Patients and Employees; 'Chaos' Ransomware Group Implicated · Data BreachIvanti Connect Secure Zero-Day Exploited in Active Attacks Targeting Healthcare VPN Infrastructure · Data BreachMetaencryptor Ransomware Group Claims Attack on MyMichigan Health, University of Michigan-Affiliated 26-County Healthcare System · Data BreachPhoton Health, Healthcare Highways, and Any-Time Home Care Disclose Data Breaches; Direwolf Ransomware Group Claims Attack on Photon Health · Data BreachOracle Health / Cerner Breach Tally Climbs to Nearly 20 Million — Far Exceeding Earlier Disclosures · Data BreachSaber Healthcare and Law Firm Buchalter Disclose Patient Data Breaches; Bright Smile Dental Hit by Ransomware · Data BreachDC Medicaid Agency (DHCF) Notifies 399,086 Beneficiaries After Three-Year Online Data Exposure Added to HHS Breach Portal · Data BreachPharmacy Benefit Manager MedImpact Healthcare Systems Begins Notifying Patients of October 2025 Network Intrusion; Healthcare Software Firm Rosch Visionary Systems Also Discloses Breach · Data BreachMedical Data Rx Breach: The Gentlemen/VYPR Ransomware Group Claims Attack on Michigan Healthcare IT Vendor; Class Action Investigation Launched · Data BreachMid Florida Dermatology & Plastic Surgery Discloses Breach Affecting 85,585 Patients; Kannarr Eye Care and Indiana University Health Also Report Incidents · Data BreachCentral Ohio Primary Care Physicians Discloses Vishing-Triggered Breach Affecting 1.4 Million Patients and Employees; 'Chaos' Ransomware Group Implicated · Data BreachIvanti Connect Secure Zero-Day Exploited in Active Attacks Targeting Healthcare VPN Infrastructure · Data BreachMetaencryptor Ransomware Group Claims Attack on MyMichigan Health, University of Michigan-Affiliated 26-County Healthcare System · Data BreachPhoton Health, Healthcare Highways, and Any-Time Home Care Disclose Data Breaches; Direwolf Ransomware Group Claims Attack on Photon Health · Data BreachOracle Health / Cerner Breach Tally Climbs to Nearly 20 Million — Far Exceeding Earlier Disclosures · Data BreachSaber Healthcare and Law Firm Buchalter Disclose Patient Data Breaches; Bright Smile Dental Hit by Ransomware · Data BreachDC Medicaid Agency (DHCF) Notifies 399,086 Beneficiaries After Three-Year Online Data Exposure Added to HHS Breach Portal · Data BreachPharmacy Benefit Manager MedImpact Healthcare Systems Begins Notifying Patients of October 2025 Network Intrusion; Healthcare Software Firm Rosch Visionary Systems Also Discloses Breach · Data Breach

OCR Enforcement Insights

Every HIPAA Penalty. Tracked and Analyzed.

The most comprehensive database of HHS OCR enforcement actions, settlements, and data breaches, sourced directly from official HHS records and updated continuously.

Enforcement actions tracked

223

Total penalties assessed

$120.8M

Individuals affected (breaches in hub)

64,814,040

Largest single penalty

$16.0M

Anthem pays OCR $16 Million in record HIPAA settlement following largest health data breach in history

Penalties by year

Aggregate OCR/HHS penalty dollars in the medcomply enforcement dataset.

Showing 25 of 223 enforcement actions

Filtered total: $120,764,203 in penalties

EntityStateTypePenaltyDateViolationsDetails

Ambry Genetics to Pay $700,000 After Phishing Attack Exposed 225,000 Patients' Health Data

—Resolution agreement$700,000Sep 2026
View →

HHS’ Office for Civil Rights Settles HIPAA Right of Access Investigation with Azul Vision, Inc.

—Settlement, Aug 2026
View →

HHS’ Office for Civil Rights Settles HIPAA Privacy Rule Investigation with Dr. Linda L. Shen d/b/a Shen Smiles, P.C.

—Settlement, Aug 2026
View →

HHS’ Office for Civil Rights Settles Ransomware Investigation with Healthcare System

—Settlement, Jul 2026
View →

Spencer Gifts LLC Resolution Agreement

—Resolution agreement, May 2026
View →

HHS’ Office for Civil Rights Settles HIPAA Investigation of MMG Fusion, LLC Breach

—Settlement, Mar 2026
View →

SG Health Plan Resolution Agreement and Corrective Action Plan

—Resolution agreement, Jan 2026
View →

Consociate, Inc. Resolution Agreement and Corrective Action Plan

—Resolution agreement, Dec 2025
View →

Assured Imaging Resolution Agreement and Corrective Action Plan

—Resolution agreement, Dec 2025
View →

Regional Women’s Health Group, LLC Resolution Agreement and Corrective Action Plan

—Resolution agreement, Aug 2025
View →

HHS’ Office for Civil Rights Settles HIPAA Ransomware Security Rule Investigation with BST & Co. CPAs, LLP

—Settlement, Aug 2025
View →

HHS’ Office for Civil Rights Settles HIPAA Ransomware Investigation with Syracuse ASC

—Settlement, Jul 2025
View →

HHS’ Office for Civil Rights Settles HIPAA Privacy and Security Rule Investigation with a Behavioral Health Provider

—Settlement, Jul 2025
View →

Top of the World Ranch Treatment Center, LLC Resolution Agreement

—Resolution agreement, Jun 2025
View →

HHS Office for Civil Rights Settles HIPAA Ransomware Cybersecurity Investigation with Comstar, LLC

—Settlement, May 2025
View →

HHS Office for Civil Rights Settles HIPAA Security Rule Investigation with a Florida Health Care Provider

—Settlement, May 2025
View →

HHS Office for Civil Rights Settles HIPAA Cybersecurity Investigation with Vision Upright MRI

—Settlement, May 2025
View →

Concentra Settlement Agreement

—Settlement, Apr 2025
View →

HHS Office for Civil Rights Settles HIPAA Ransomware Cybersecurity Investigation with Neurology Practice

—Settlement, Apr 2025
View →

HHS Office for Civil Rights Settles Phishing Attack Breach with Health Care Network for $600,000

—Settlement$600,000Apr 2025
View →

Cadia Rehabilitation Resolution Agreement

—Resolution agreement, Apr 2025
View →

HHS Office for Civil Rights Settles HIPAA Ransomware Cybersecurity Investigation with Public Hospital

—Settlement, Apr 2025
View →

HHS Office for Civil Rights Settles HIPAA Security Rule Investigation with Northeast Radiology

—Settlement, Apr 2025
View →

HHS’ Office for Civil Rights Settles HIPAA Security Rule Investigation with Health Fitness Corporation

—Settlement, Mar 2025
View →

HHS Office for Civil Rights Imposes a $200,000 Penalty Against Oregon Health & Science University for Failure to Provide Timely Access to Patient Records

—CMP$200,000Mar 2025
View →

Page 1 of 9

Download full dataset →