News
Medical Data Rx Breach: The Gentlemen/VYPR Ransomware Group Claims Attack on Michigan Healthcare IT Vendor; Class Action Investigation Launched · Data BreachMid Florida Dermatology & Plastic Surgery Discloses Breach Affecting 85,585 Patients; Kannarr Eye Care and Indiana University Health Also Report Incidents · Data BreachCentral Ohio Primary Care Physicians Discloses Vishing-Triggered Breach Affecting 1.4 Million Patients and Employees; 'Chaos' Ransomware Group Implicated · Data BreachIvanti Connect Secure Zero-Day Exploited in Active Attacks Targeting Healthcare VPN Infrastructure · Data BreachMetaencryptor Ransomware Group Claims Attack on MyMichigan Health, University of Michigan-Affiliated 26-County Healthcare System · Data BreachPhoton Health, Healthcare Highways, and Any-Time Home Care Disclose Data Breaches; Direwolf Ransomware Group Claims Attack on Photon Health · Data BreachOracle Health / Cerner Breach Tally Climbs to Nearly 20 Million — Far Exceeding Earlier Disclosures · Data BreachSaber Healthcare and Law Firm Buchalter Disclose Patient Data Breaches; Bright Smile Dental Hit by Ransomware · Data BreachDC Medicaid Agency (DHCF) Notifies 399,086 Beneficiaries After Three-Year Online Data Exposure Added to HHS Breach Portal · Data BreachPharmacy Benefit Manager MedImpact Healthcare Systems Begins Notifying Patients of October 2025 Network Intrusion; Healthcare Software Firm Rosch Visionary Systems Also Discloses Breach · Data BreachMedical Data Rx Breach: The Gentlemen/VYPR Ransomware Group Claims Attack on Michigan Healthcare IT Vendor; Class Action Investigation Launched · Data BreachMid Florida Dermatology & Plastic Surgery Discloses Breach Affecting 85,585 Patients; Kannarr Eye Care and Indiana University Health Also Report Incidents · Data BreachCentral Ohio Primary Care Physicians Discloses Vishing-Triggered Breach Affecting 1.4 Million Patients and Employees; 'Chaos' Ransomware Group Implicated · Data BreachIvanti Connect Secure Zero-Day Exploited in Active Attacks Targeting Healthcare VPN Infrastructure · Data BreachMetaencryptor Ransomware Group Claims Attack on MyMichigan Health, University of Michigan-Affiliated 26-County Healthcare System · Data BreachPhoton Health, Healthcare Highways, and Any-Time Home Care Disclose Data Breaches; Direwolf Ransomware Group Claims Attack on Photon Health · Data BreachOracle Health / Cerner Breach Tally Climbs to Nearly 20 Million — Far Exceeding Earlier Disclosures · Data BreachSaber Healthcare and Law Firm Buchalter Disclose Patient Data Breaches; Bright Smile Dental Hit by Ransomware · Data BreachDC Medicaid Agency (DHCF) Notifies 399,086 Beneficiaries After Three-Year Online Data Exposure Added to HHS Breach Portal · Data BreachPharmacy Benefit Manager MedImpact Healthcare Systems Begins Notifying Patients of October 2025 Network Intrusion; Healthcare Software Firm Rosch Visionary Systems Also Discloses Breach · Data Breach
resolution agreement

FAQs for Professionals: Corrective action / RA

Resolution ,

Penalty

Corrective action / RA

Action type

Resolution agreement

Entity profile

—

Case number

—

What went wrong

FAQs for Professionals

  • Navigate to: Authorizations (30) Business Associates (41) Compliance Dates (2) Covered Entities (14) Decedents (9) Disclosures for Law Enforcement Purposes (5) Disclosures for Rule Enforcement (1) Disclosures in Emergency Situations (2) Disclosures Required by Law (6) Disclosures to Family and Friends (28) Disposal of Protected Health Information (6) Facility Directories (7) Family Medical History

Full description

Navigate to: Authorizations (30) Business Associates (41) Compliance Dates (2) Covered Entities (14) Decedents (9) Disclosures for Law Enforcement Purposes (5) Disclosures for Rule Enforcement (1) Disclosures in Emergency Situations (2) Disclosures Required by Law (6) Disclosures to Family and Friends (28) Disposal of Protected Health Information (6) Facility Directories (7) Family Medical History Information (3) FERPA and HIPAA (10) Group Health Plans (3) Incidental Uses and Disclosures (10) Judicial and Administrative Proceedings (8) Minimum Necessary (14) Notice of Privacy Practice (20) Preemption of State Law (10) Privacy Rule: General Topics (12) Protected Health Information (2) Public Health Uses and Disclosures (13) Research Uses and Disclosures (20) Right to an Accounting of Disclosures (8) Right to File a Complaint (1) Right to Request a Restriction (4) Safeguards (13) Security Rule (24) Smaller Providers and Businesses (145) Student Immunizations (8) Transition Provisions (3) Treatment, Payment, and Health Care Operations Disclosures (31) Workers Compensation Disclosures (5) Limited Data Set (6) Marketing (17) Marketing - Refill Reminders (16) Personal Representatives and Minors (12) Right to Access and Research (58) Mental Health (34) Health Information Technology (39) Telehealth (11) HIPAA FAQs for Professionals Search frequently asked questions about HIPAA by category, number, or keyword. Please note that some older FAQs have been sent to archive. This content is searchable using the search term ‘HIPAA FAQs’ at https://archive-it.org/collections/4657. FAQs by Category Select a Category Authorizations Business Associates Compliance Dates Covered Entities Decedents Disclosures for Law Enforcement Purposes Disclosures for Rule Enforcement Disclosures in Emergency Situations Disclosures Required by Law Disclosures to Family and Friends Disposal of Protected Health Information Facility Directories Family Medical History Information FERPA and HIPAA Group Health Plans Incidental Uses and Disclosures Judicial and Administrative Proceedings Minimum Necessary Notice of Privacy Practice Preemption of State Law Privacy Rule: General Topics Protected Health Information Public Health Uses and Disclosures Research Uses and Disclosures Right to an Accounting of Disclosures Right to File a Complaint Right to Request a Restriction Safeguards Security Rule Smaller Providers and Businesses Student Immunizations Transition Provisions Treatment, Payment, and Health Care Operations Disclosures Workers Compensation Disclosures Limited Data Set Marketing Marketing - Refill Reminders Personal Representatives and Minors Right to Access and Research Mental Health Health Information Technology Telehealth Search HIPAA FAQs by questions or keywords: Search HIPAA FAQs by questions or keywords Search Content last reviewed October 12, 2017

Timeline

  • Resolution,
  • Incident and investigation milestones are not consistently published by OCR in machine-readable form.

Key takeaways for your organization

  • Document permitted uses and disclosures; obtain valid authorizations before marketing or public-facing communications that include PHI.
  • Align policies, procedures, and evidence with the specific CFR provisions cited in OCR resolutions affecting your entity type.
  • Run tabletop exercises for breach response, OCR inquiry handling, and privilege-preserving communications with counsel.
  • Revisit business associate inventory and downstream vendor security assurances after major enforcement themes in your sector.

Related actions

Source

U.S. Department of Health and Human Services release

Source: U.S. Department of Health and Human Services, Office for Civil Rights. medcomply.ai aggregates public materials for educational use, not legal advice.