News
Medical Data Rx Breach: The Gentlemen/VYPR Ransomware Group Claims Attack on Michigan Healthcare IT Vendor; Class Action Investigation Launched · Data BreachMid Florida Dermatology & Plastic Surgery Discloses Breach Affecting 85,585 Patients; Kannarr Eye Care and Indiana University Health Also Report Incidents · Data BreachCentral Ohio Primary Care Physicians Discloses Vishing-Triggered Breach Affecting 1.4 Million Patients and Employees; 'Chaos' Ransomware Group Implicated · Data BreachIvanti Connect Secure Zero-Day Exploited in Active Attacks Targeting Healthcare VPN Infrastructure · Data BreachMetaencryptor Ransomware Group Claims Attack on MyMichigan Health, University of Michigan-Affiliated 26-County Healthcare System · Data BreachPhoton Health, Healthcare Highways, and Any-Time Home Care Disclose Data Breaches; Direwolf Ransomware Group Claims Attack on Photon Health · Data BreachOracle Health / Cerner Breach Tally Climbs to Nearly 20 Million — Far Exceeding Earlier Disclosures · Data BreachSaber Healthcare and Law Firm Buchalter Disclose Patient Data Breaches; Bright Smile Dental Hit by Ransomware · Data BreachDC Medicaid Agency (DHCF) Notifies 399,086 Beneficiaries After Three-Year Online Data Exposure Added to HHS Breach Portal · Data BreachPharmacy Benefit Manager MedImpact Healthcare Systems Begins Notifying Patients of October 2025 Network Intrusion; Healthcare Software Firm Rosch Visionary Systems Also Discloses Breach · Data BreachMedical Data Rx Breach: The Gentlemen/VYPR Ransomware Group Claims Attack on Michigan Healthcare IT Vendor; Class Action Investigation Launched · Data BreachMid Florida Dermatology & Plastic Surgery Discloses Breach Affecting 85,585 Patients; Kannarr Eye Care and Indiana University Health Also Report Incidents · Data BreachCentral Ohio Primary Care Physicians Discloses Vishing-Triggered Breach Affecting 1.4 Million Patients and Employees; 'Chaos' Ransomware Group Implicated · Data BreachIvanti Connect Secure Zero-Day Exploited in Active Attacks Targeting Healthcare VPN Infrastructure · Data BreachMetaencryptor Ransomware Group Claims Attack on MyMichigan Health, University of Michigan-Affiliated 26-County Healthcare System · Data BreachPhoton Health, Healthcare Highways, and Any-Time Home Care Disclose Data Breaches; Direwolf Ransomware Group Claims Attack on Photon Health · Data BreachOracle Health / Cerner Breach Tally Climbs to Nearly 20 Million — Far Exceeding Earlier Disclosures · Data BreachSaber Healthcare and Law Firm Buchalter Disclose Patient Data Breaches; Bright Smile Dental Hit by Ransomware · Data BreachDC Medicaid Agency (DHCF) Notifies 399,086 Beneficiaries After Three-Year Online Data Exposure Added to HHS Breach Portal · Data BreachPharmacy Benefit Manager MedImpact Healthcare Systems Begins Notifying Patients of October 2025 Network Intrusion; Healthcare Software Firm Rosch Visionary Systems Also Discloses Breach · Data Breach
resolution agreement

Reports to Congress: Corrective action / RA

Resolution ,

Penalty

Corrective action / RA

Action type

Resolution agreement

Entity profile

—

Case number

—

What went wrong

Reports to Congress

  • Navigate to: HIPAA for Professionals Regulatory Initiatives Privacy Summary of the Privacy Rule Guidance Combined Text of All Rules HIPAA Related Links Security Security Rule NPRM Summary of the Security Rule Security Guidance Cyber Security Guidance Breach Notification Breach Reporting Guidance Reports to Congress Regulation History Compliance & Enforcement Enforcement Rule Enforcement Process En

CFR citations

45 CFR Parts

Full description

Navigate to: HIPAA for Professionals Regulatory Initiatives Privacy Summary of the Privacy Rule Guidance Combined Text of All Rules HIPAA Related Links Security Security Rule NPRM Summary of the Security Rule Security Guidance Cyber Security Guidance Breach Notification Breach Reporting Guidance Reports to Congress Regulation History Compliance & Enforcement Enforcement Rule Enforcement Process Enforcement Data Resolution Agreements Case Examples Audit Reports to Congress State Attorneys General Special Topics Parental Access Mental and Behavioral Health Change Healthcare Cybersecurity Incident FAQs HIPAA and COVID-19 HIPAA and Reproductive Health HIPAA and Final Rule Notice HIPAA and Telehealth HIPAA and FERPA Research Public Health Emergency Response Health Information Technology Health Apps Patient Safety Covered Entities & Business Associates Business Associate Contracts Business Associates Training & Resources FAQs for Professionals Other Administrative Simplification Rules Substance Use Disorder Confidentiality Reports to Congress on Privacy Rule and Security Rule Compliance Section 13424(a) of the Health Information Technology for Economic and Clinical Health (HITECH) Act requires the Secretary of the Department of Health and Human Services (the Department) to prepare and submit an annual report to Congress regarding compliance with the Privacy and Security Rules promulgated under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Pub. L. 104-191). In addition, Section 13424(a)(2) of the HITECH Act requires that each report be made available to the public on the web site of the Department.The following report was prepared in accordance with these statutory requirements. For the years for which the report is prepared, the report summarizes complaints received by the Department of alleged violations of the provisions of Subtitle D of the HITECH Act, as well as of the HIPAA Privacy, Security and Breach Notification Rules at 45 CFR Parts 160 and 164.2022 Report to Congress on HIPAA Privacy, Security, and Breach Notification Rule Compliance2021 Report to Congress on HIPAA Privacy, Security, and Breach Notification Compliance2020 Report to Congress on HIPAA Privacy, Security, and Breach Notification Compliance2019 Report to Congress on HIPAA Privacy, Security, and Breach Notification Compliance*2018 Report to Congress on HIPAA Privacy, Security, and Breach Notification Compliance*2015-2016-2017 Report to Congress on HIPAA Privacy, Security, and Breach Notification Compliance - Submitted to Congress on February 22, 2019.2013 - 2014 Submission Letter to the Report to Congress on HIPAA Privacy, Security and Breach Notification Compliance2013 - 2014 Report to Congress on HIPAA privacy, Security and Breach Notification Compliance2011 – 2012 Submission Letter for the Report to Congress on HIPAA Privacy, Security and Breach Notification Compliance2011 – 2012 Report to Congress on HIPAA Privacy, Security and Breach Notification Compliance2009 - 2010 Submission Letter for the Report to Congress on Privacy Rule and Security Rule Compliance2009 - 2010 Report to Congress on Privacy Rule and Security Rule Compliance* People using assistive technology may not be able to fully access information in this file. For assistance, contact the HHS Office for Civil Rights at (800) 368-1019, TDD toll-free: (800) 537-7697, or by emailing OCRMail@hhs.gov.View the Reports to Congress on Breach Notification Content last reviewed February 22, 2024

Timeline

  • Resolution,
  • Incident and investigation milestones are not consistently published by OCR in machine-readable form.

Key takeaways for your organization

  • Treat internet-facing systems and vendor-hosted environments as in-scope for HIPAA risk analysis and technical safeguards testing.
  • Maintain an actionable risk analysis tied to remediation milestones; evidence should map to Security Rule implementation specifications.
  • Align policies, procedures, and evidence with the specific CFR provisions cited in OCR resolutions affecting your entity type.
  • Run tabletop exercises for breach response, OCR inquiry handling, and privilege-preserving communications with counsel.

Related actions

Source

U.S. Department of Health and Human Services release

Source: U.S. Department of Health and Human Services, Office for Civil Rights. medcomply.ai aggregates public materials for educational use, not legal advice.