HHS Office for Civil Rights Settles Ransomware Cybersecurity Investigation under HIPAA Security Rule for $250,000 — $250,000
Resolution Sep 2024
Penalty
$250,000
Action type
Settlement
Entity profile
—
Case number
—
What went wrong
HHS Office for Civil Rights Settles Ransomware Cybersecurity Investigation under HIPAA Security Rule for $250,000 - September 26, 2024
Timeline
- ResolutionSep 2024
- Incident and investigation milestones are not consistently published by OCR in machine-readable form.
Key takeaways for your organization
- Align policies, procedures, and evidence with the specific CFR provisions cited in OCR resolutions affecting your entity type.
- Run tabletop exercises for breach response, OCR inquiry handling, and privilege-preserving communications with counsel.
- Revisit business associate inventory and downstream vendor security assurances after major enforcement themes in your sector.
Related actions
OCR Resolves Twentieth Investigation in HIPAA Right of Access Initiative with $80,000 Settlement
—
$80,000
Clinical Laboratory Pays $25,000 to Settle Potential HIPAA Security Rule Violations
—
$25,000
HHS Office for Civil Rights Imposes a $200,000 Penalty Against Oregon Health & Science University for Failure to Provide Timely Access to Patient Records
—
$200,000
Source
U.S. Department of Health and Human Services release
Source: U.S. Department of Health and Human Services, Office for Civil Rights. medcomply.ai aggregates public materials for educational use — not legal advice.