HHS’ Office for Civil Rights Settles HIPAA Ransomware Security Rule Investigation with BST & Co. CPAs, LLP: HIPAA resolution HIPAA Penalty (2025)

medcomply.ai editorial team

settlement

HHS’ Office for Civil Rights Settles HIPAA Ransomware Security Rule Investigation with BST & Co. CPAs, LLP: Corrective action / RA

Resolution Aug 2025

Penalty

Corrective action / RA

Action type

Settlement

Entity profile

—

Case number

—

What went wrong

HHS’ Office for Civil Rights Settles HIPAA Ransomware Security Rule Investigation with BST & Co. CPAs, LLP

Timeline

ResolutionAug 2025
Incident and investigation milestones are not consistently published by OCR in machine-readable form.

Key takeaways for your organization

Align policies, procedures, and evidence with the specific CFR provisions cited in OCR resolutions affecting your entity type.
Run tabletop exercises for breach response, OCR inquiry handling, and privilege-preserving communications with counsel.
Revisit business associate inventory and downstream vendor security assurances after major enforcement themes in your sector.

Related actions

Ambry Genetics to Pay $700,000 After Phishing Attack Exposed 225,000 Patients' Health Data

—

$700,000

HHS’ Oﬃce for Civil Rights Settles HIPAA Privacy Rule Investigation with Dr. Linda L. Shen d/b/a Shen Smiles, P.C.

—

,

Ending Anti-Semitism on College Campuses

—

,

Source

U.S. Department of Health and Human Services release

Source: U.S. Department of Health and Human Services, Office for Civil Rights. medcomply.ai aggregates public materials for educational use, not legal advice.