In August, the Office for Civil Rights (OCR) published guidance relating to individuals’ rights to access their protected health information (PHI) under HIPAA. As we covered in our earlier blog post about the August guidance, the new FAQs came amidst OCR’s continued enforcement focus on its Right of Access initiative, under which the OCR has
Office for Civil Rights
Northeast Radiology Settles with OCR
By Linn Foster Freedman on
Posted in Health Information Privacy
The Office for Civil Rights (OCR) announced on April 10, 2025, that it has settled alleged HIPAA Security Rule violations with Northeast Radiology for $350,000.
The investigation followed a breach report by Northeast Radiology to OCR in March 2020 after unauthorized individuals accessed radiology images stored in PAC servers. Northeast Radiology notified 298,532 patients of…
Warby Parker Settles Data Breach Case with OCR for $1.5M
By Linn Foster Freedman on
Posted in Data Breach, HIPAA and Health Information
Eyeglass manufacturer and retailer Warby Parker recently settled a 2018 data breach investigation by the Office for Civil Rights (OCR) for $1.5 million. According to OCR’s press release, Warby Parker self-reported that between September and November of 2018, unauthorized third parties had access to customer accounts following a credential stuffing attack. The names, mailing and…
What to Know About the HHS HIPAA Security Standards Proposal
By Kathryn Rattigan & Conor Duffy on
Posted in HIPAA and Health Information
At the close of 2024, the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services (HHS) issued a Notice of Proposed Rulemaking (the Proposed Rule) to amend the Security Rule regulations established for protecting electronic health information under the Health Insurance Portability and Accountability Act of 1996 (HIPAA). The updated…
OCR Active with Settlements and Enforcement Actions in November and Early December
By Linn Foster Freedman on
Posted in HIPAA and Health Information
The Office for Civil Rights of the Department of Health and Human Services (OCR) was busy negotiating and settling enforcement actions in November and early December. Since October 31, 2024, the OCR has settled five separate cases of alleged HIPAA violations. The settlements include resolution agreements and civil monetary penalties.
One of the settlements and…
Annual Breach Notification Deadline to OCR Looming
By Linn Foster Freedman on
Posted in HIPAA and Health Information
HIPAA requires that covered entities notify the Office for Civil Rights (OCR) of any breaches of unsecured protected health information that affects less than 500 individuals in a calendar year within 60 days following the end of the calendar year.
Therefore, all breaches that affected less than 500 individuals that occurred in 2022 and have…
OCR Settles Eleven More Cases Under Right of Access Initiative
By Linn Foster Freedman on
Posted in HIPAA and Health Information
Making quite the statement on July 15, 2022, the Office for Civil Rights (OCR) announced in a press release that it had recently settled an additional 11 cases under its Right to Access Initiative. These settlements bring the total number of enforcement actions under the Initiative to 38.
The settlements, ranging from $3,500 to…
OCR Announces 20th Settlement Under Right of Access Initiative
By Linn Foster Freedman on
The Office for Civil Rights (OCR) recently announced that it has entered into the 20th settlement under its Right of Access Initiative. The settlement with Children’s Hospital and Medical Center in Nebraska includes an $80,000 payment by the hospital for failing to provide a mother with timely access to her daughter’s medical records.
According…
OCR Settles Two More Right of Access Cases
By Linn Foster Freedman on
Posted in HIPAA and Health Information
Continuing its serious march against covered entities not allowing patients access to their records, the Office for Civil Rights (OCR) has settled two more cases in two days in its Right of Access Initiative. This brings the tally of OCR’s settlements to a total of 18.
The 17th settlement, with The Arbour, Inc., d/b/a Arbour…
OCR Continues to Enforce Its HIPAA Right of Access Initiative
By Linn Foster Freedman on
The Office for Civil Rights (OCR) recently announced another settlement involving investigations under its Right of Access Initiative. This settlement, the sixteenth such agreement under the Initiative (and one of the most interesting), involves San Diego-based Sharp HealthCare, doing business as Sharp Rees-Stealy Medical Centers (SRMC). In the settlement, OCR alleged that it received a…