Skip to main content


U.S. flag
      An official website of the United States government
              Here’s how you know
        Here’s how you knowDot gov**Official websites use .gov**
                 A **.gov** website belongs to an official government organization in the United States.
                  HTTPS**Secure .gov websites use HTTPS**
                 A **lock** (A locked padlock) or **https://** means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites. 
  Menu Close
          Enter the terms you wish to search for.
    Search
        








  
  
    

  
      

                                      About HHS
    
                        
                              
      
      
      Programs & Services
    
                        
                              
      
      
      Grants & Contracts
    
                        
                              
      
      
      Laws & Regulations                  
Health Information Privacy
  HIPAA for Individuals
    
                        
                                            
      
      
      Filing a Complaint
    
                        
                                            
      
      
      HIPAA for Professionals
    
                        
                                                                  
      
      
      Newsroom

              

    



Breadcrumb
    HHS
                              HIPAA Home
                              HIPAA News Releases


    

    

    Navigate to:
  Office for Civil Rights Speaker RequestText resize icon

                    




HIPAA News Releases & Bulletins








  
  
    

  
      



HHS OCR Imposes a CMP on NJ Nursing Facility for Failing to Provide Timely Access to Patient Records - April 1, 2024HHS’ OCR Settles HIPAA Investigation with Phoenix Healthcare - March 29, 2024HHS Office for Civil Rights Issues Letter and Opens Investigation of Change Healthcare Cyberattack - March 13, 2024HHS OCR Work with Hospital to Improve Access to Kosher Electronic Devices Use for Virtual Patient Visitation - March 5, 2024HHS Finalizes New Provisions to Enhance Integrated Care and Confidentiality for Patients with Substance Use Conditions – February 8, 2024HHS’ Office for Civil Rights Settles Malicious Insider Cybersecurity Investigation for $4.75 Million - February 6, 2024HHS’ Office for Civil Rights Settles HIPAA Investigation of St. Joseph’s Medical Center for Disclosure of Patients’ Protected Health Information to a News Reporter - November 20, 2023HHS’ Office for Civil Rights Settles Ransomware Cyber-Attack Investigation with Doctors’ Management Services - October 31, 2023October 2023 OCR Cybersecurity Newsletter: How Sanction Policies Can Support HIPAA Compliance - October 19, 2023HHS Office for Civil Rights Settles with L.A. Care Health Plan Over Potential HIPAA Security Rule Violations - September 11, 2023UnitedHealthcare Pays $80,000 Settlement to HHS to Resolve HIPAA Matter over Patient Medical Records Request – August 24, 2023HHS OCR & FTC Warn Hospital Systems and Telehealth Providers about Privacy and Security Risks from Online Tracking Tech – July 20, 2023OCR/FTC Letters** People using assistive technology may not be able to fully access information in this file. For assistance, contact the HHS Office for Civil Rights at (800) 368-1019, TDD toll-free: (800) 537-7697, or by emailing OCRMail@hhs.gov.HHS Office for Civil Rights Settles HIPAA Investigation with iHealth Solutions Regarding Disclosure of Protected Health Information on an Unsecured Server for $75,000 – June 28, 2023Snooping in Medical Records by Hospital Security Guards Leads to $240,000 HIPAA Settlement – June 15, 2023HHS Office for Civil Rights Reaches Agreement with Health Care Provider in New Jersey That Disclosed Patient Information in Response to Negative Online Reviews – June 5, 2023HHS Office for Civil Rights Settles HIPAA Investigation with Arkansas Business Associate MedEvolve Following Unlawful Disclosure of Protected Health Information on an Unsecured Server for $350,000 – May 16, 2023HHS Office for Civil Rights Enters Into $15,000 Settlement Resolving Potential HIPAA Violation Under the Right of Access Initiative – May 8, 2023HHS Proposes Measures to Bolster Patient-Provider Confidentiality Around Reproductive Health Care - April 12, 2023OCR Announces Expiration of COVID-19 PHE HIPAA Notifications of Enforcement Discretion - April 11, 2023HHS Office for Civil Rights Delivers Annual Reports to Congress on HIPAA Compliance and Breaches of Unsecured Protected Health Information - February 17, 2023HHS Office for Civil Rights Settles HIPAA Investigation with Arizona Hospital System Following Cybersecurity Hacking - February 2, 2023HHS Office for Civil Rights Issues Bulletin on Requirements under HIPAA for Online Tracking Technologies to Protect the Privacy and Security of Health Information - December 1, 2022HHS Office for Civil Rights and SAMHSA Propose New Protections to Help Increase Care Coordination and Confidentiality for Patient Substance Use Disorder Records - November 28, 2022OCR Settles Three Cases with Dental Practices for Patient Right of Access under HIPAA - September 20, 2022OCR Settles Case Concerning Improper Disposal of Protected Health Information - August 23, 2022Eleven Enforcement Actions Uphold Patients’ Rights Under HIPAA - July 15, 2022Oklahoma State University - Center for Health Services Pays $875,000 to Settle Hacking Breach - July 14, 2022HHS Issues Guidance to Protect Patient Privacy in Wake of Supreme Court Decision on Roe - June 29, 2022HHS Issues Guidance on HIPAA and Audio-Only Telehealth - June 13, 2022HHS' Office for Civil Rights Seeks Public Comment on Recognized Security Practices and Sharing Civil Money Penalties and Monetary Settlements Under the HITECH Act - April 6, 2022Four HIPAA enforcement actions hold healthcare providers accountable with compliance - March 28, 2022HHS Notice and Guidance on Gender Affirming Care, Civil Rights, and Patient Privacy - March 2, 2022Statement by HHS Secretary Xavier Becerra Reaffirming HHS Support and Protection for LGBTQI+ Children and Youth - March 2, 2022Improving the Cybersecurity Posture of Healthcare in 2022 - February 28, 2022HHS Issues Guidance on HIPAA and Disclosures of Protected Health Information for Extreme Risk Protection Orders - December 20, 2021HHS Office for Civil Rights Commemorates World AIDS Day - December 1, 2021Five enforcement actions hold healthcare providers accountable for HIPAA Right of Access - November 30, 2021OCR Issues Guidance on HIPAA, COVID-19 Vaccinations, and the Workplace - September 30, 2021U.S. Department of Health and Human Services Announces Lisa J. Pino as Director for Office for Civil Rights - September 27, 2021El Departamento de Salud y Servicios Humanos de los EE. UU. Anuncia a Lisa J. Pino como Directora de la Oficina de Derechos Civiles - 27 de septiembre de 2021OCR Resolves Twentieth Investigation in HIPAA Right of Access Initiative with $80,000 Settlement - September 10, 2021OCR Settles Nineteenth Investigation in HIPAA Right of Access Initiative - June 2, 2021Clinical Laboratory Pays $25,000 to Settle Potential HIPAA Security Rule Violations - May 25, 2021OCR Settles Eighteenth Investigation in HIPAA Right of Access Initiative - March 26, 2021OCR Settles Seventeenth Investigation in HIPAA Right of Access Initiative - March 24, 2021Extension of the Public Comment Period for Proposed Modifications to the HIPAA Privacy Rule - March 9, 2021OCR Settles Sixteenth Investigation in HIPAA Right of Access Initiative - February 12, 2021OCR Settles Fifteenth Investigation in HIPAA Right of Access Initiative - February 10, 2021OCR Announces Notification of Enforcement Discretion for Use of Online or Web-Based Scheduling Applications for the Scheduling of COVID-19 Vaccination Appointments - January 19, 2021Health Insurer Pays $5.1 Million to Settle Data Breach Affecting Over 9.3 Million People - January 15, 2021OCR Settles Fourteenth Investigation in HIPAA Right of Access Initiative - January 12, 2021OCR Settles Thirteenth Investigation in HIPAA Right of Access Initiative - December 22, 2020OCR Issues Guidance on HIPAA, Health Information Exchanges, and Disclosures of Protected Health Information for Public Health Purposes - December 18, 2020OCR Issues Audit Report on Health Care Industry Compliance with the HIPAA Rules - December 17, 2020HHS Proposes Modifications to the HIPAA Privacy Rule to Empower Patients, Improve Coordinated Care, and Reduce Regulatory Burdens - December 10, 2020OCR Settles Twelfth Investigation in HIPAA Right of Access Initiative - November 19, 2020OCR Settles Eleventh Investigation in HIPAA Right of Access Initiative - November 12, 2020OCR Settles Tenth Investigation in HIPAA Right of Access Initiative - November 6, 2020City Health Department failed to terminate former employee’s access to protected health information- October 30, 2020Aetna Pays $1,000,000 to Settle Three HIPAA Breaches - October 28, 2020OCR Settles Ninth Investigation in HIPAA Right of Access Initiative - October 9, 2020OCR Settles Eighth Investigation in HIPAA Right of Access Initiative - October 7, 2020Health Insurer Pays $6.85 Million to Settle Data Breach Affecting Over 10.4 Million People - September 25, 2020HIPAA Business Associate Pays $2.3 Million to Settle Breach Affecting Protected Health Information of Over 6 million Individual - September 23, 2020Orthopedic Clinic Pays $1.5 Million to Settle Systemic Noncompliance with HIPAA Rules - September 21, 2020OCR Settles Five More Investigations in HIPAA Right of Access Initiative - September 15, 2020Trump Administration Adds Health Plans to June 2020 Plasma Donation Guidance - August 24, 2020Lifespan Pays $1,040,000 to OCR to Settle Unencrypted Stolen Laptop Breach - July 27, 2020Small Health Care Provider Fails to Implement Multiple HIPAA Security Rule Requirements - July 23, 2020OCR Issues Guidance on How Health Care Providers Can Contact Former COVID-19 Patients About Blood and Plasma Donation Opportunities - June 12, 2020OCR Issues Guidance on Covered Health Care Providers and Restrictions on Media Access to Protected Health Information about Individuals in Their Facilities - May 5, 2020OCR Announces Notification of Enforcement Discretion for Community-Based Testing Sites During the COVID-19 Nationwide Public Health Emergency - April 9, 2020OCR Announces Notification of Enforcement Discretion to Allow Uses and Disclosures of Protected Health Information by Business Associates for Public Health and Health Oversight Activities During The COVID-19 Nationwide Public Health Emergency - April 2, 2020OCR Issues Bulletin on Civil Rights Laws and HIPAA Flexibilities That Apply During the COVID-19 Emergency - March 28, 2020OCR Issues Guidance to Help Ensure First Responders and Others Receive Protected Health Information about Individuals Exposed to COVID-19 - March 24, 2020OCR Issues Guidance on Telehealth Remote Communications Following Its Notification of Enforcement Discretion - March 20, 2020OCR Announces Notification of Enforcement Discretion for Telehealth Remote Communications During the COVID-19 Nationwide Public Health Emergency - March 17, 2020Health Care Provider Pays $100,000 Settlement to OCR for Failing to Implement HIPAA Security Rule Requirements - March 3, 2020OCR Issues Guidance to Help Ensure Equal Access to Emergency Services and the Appropriate Sharing of Medical Information Following Puerto Rico Earthquakes - January 09, 2020Ambulance Company Pays $65,000 to Settle Allegations of Longstanding HIPAA Noncompliance - December 30, 2019OCR Settles Second Case in HIPAA Right of Access Initiative - December 12, 2019OCR Secures $2.175 Million HIPAA Settlement After Hospitals Failed to Properly Notify HHS of a Breach of Unsecured Protected Health Information - November 26, 2019OCR Imposes a $1.6 Million Civil Money Penalty against Texas Health and Human Services Commission for HIPAA Violations - November 7, 2019Failure to Encrypt Mobile Devices Leads to $3 Million HIPAA Settlement - November 5, 2019OCR Imposes a $2.15 Million Civil Money Penalty against Jackson Health System for HIPAA Violations - October 23, 2019Dental Practice Pays $10,000 to Settle Social Media Disclosures of Patients’ Protected Health Information - October 2, 2019OCR Settles First Case in HIPAA Right of Access Initiative - September 9, 2019OCR Issues Guidance to Help Ensure Equal Access to Emergency Services and the Appropriate Sharing of Medical Information during Hurricane Dorian - September 3, 2019Indiana Medical Records Service Pays $100,000 to Settle HIPAA Breach - May 23, 2019Tennessee Diagnostic Medical Imaging Services Company Pays $3,000,000 to Settle Breach Exposing Over 300,000 Patients' Protected Health Information - May 6, 2019OCR Concludes 2018 with All-Time Record Year for HIPAA Enforcement - February 7, 2019Cottage Health Settles Potential Violations of HIPAA Rules for $3 Million - February 7, 2019Colorado hospital failed to terminate former employee’s access to electronic protected health information - December 11, 2018Florida contractor physicians' group shares protected health information with unknown vendor without a business associate agreement - December 4, 2018Allergy Practice pays $125,000 to settle doctor's disclosure of patient information to a reporter - November 26, 2018**OCR provides FAQs on Patient Access and APIs**OCR released frequently asked questions about the Health Insurance Portability and Accountability Act (HIPAA) right of access related to apps designated by the individual and application programming interfaces (APIs) used by the provider’s electronic health record system. This release was in conjunction with CMS and ONC announcing that they are extending the public comment period by 30 days for two proposed regulations aimed at promoting the interoperability of health information technology and enabling patients to electronically access their health information.FAQsPress Release**OCR Launches Public Education Campaign About Civil Rights Protections in Response to the National Opioid Crisis - October 25, 2018**Today, the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services (HHS) launched a public education campaign on civil rights protections in response to the national opioid crisis.  The materials inform the public about civil rights protections that may apply to a person in recovery from an opioid addiction and ensure that covered entities are aware of their obligation to comply with federal nondiscrimination laws.Read the HHS Press ReleaseVisit the OCR Opioids PageAnthem pays OCR $16 Million in record HIPAA settlement following largest health data breach in history – October 15, 2018Unauthorized Disclosure of Patients’ Protected Health Information During ABC Doumentary Filming Results in Multiple HIPAA Settlements Totaling $999,000 – September 20, 2018A previous version of this release mistakenly identified the TV series as  “Boston Med.”  “Boston Med,” also an ABC television series, was not involved in this investigation.**OCR Issues Guidance to Help Ensure Equal Access to Emergency Services and the Appropriate Sharing of Medical Information During Hurricane Florence**In preparation for Hurricane Florence, OCR has issued a press release providing resources and effective practices to help emergency responders and officials effectively serve at-risk populations and ensure that the whole community is included in emergency response and recovery efforts.  OCR continues to coordinate with our sister agencies and federal partners to make sure that responsible officials are mindful of all segments of the community as they prepare for disaster response in the areas affected by Hurricane Florence.Read the HHS Press ReleaseVisit the Civil Rights Emergency Preparedness PageVisit the HIPAA Emergency Preparedness PageJudge rules in favor of OCR and requires a Texas cancer center to pay $4.3 million in penalties for HIPAA violations - June 18, 2018Consequences for HIPAA violations don’t stop when a business closes -  February 13, 2018Five breaches add up to millions in settlement costs for entity that failed to heed HIPAA’s risk analysis and risk management rules - February 1, 2018Failure to protect the health records of millions of people costs entity millions of dollars - December 28, 2017HHS Office for Civil Rights Issues Guidance on how HIPAA Allows Information Sharing to Address the Opioid Crisis - October 27, 2017Careless handling of HIV information jeopardizes patient’s privacy, costs entity $387k - May 23, 2017Texas health system settles potential HIPAA violations for disclosing patient information - May 10, 2017$2.5 million settlement shows that not understanding HIPAA requirements creates risk - April 24, 2017No Business Associate Agreement?  $31K Mistake - April 20, 2017Overlooking risks leads to breach, $400,000 settlement - April 12, 2017$5.5 million HIPAA settlement shines light on the importance of audit controls - February 16, 2017Lack of timely action risks security and costs money - February 1, 2017HIPAA settlement demonstrates importance of implementing safeguards for ePHI - January 18, 2017Comunicado de prensa (Spanish) - PDFRead the BulletinRead the Agreement - PDFFirst HIPAA enforcement action for lack of timely breach notification settles for $475,000 - January 9, 2017UMass settles potential HIPAA violations following malware infection - November 22, 2016$2.14 million HIPAA settlement underscores importance of managing security risk - October 17, 2016OCR Releases New Guidance on HIPAA and Cloud Computing - October 6, 2016HIPAA settlement illustrates the importance of reviewing and updating, as necessary, business associate agreements - September 23, 2016Advocate Health Care Settles Potential HIPAA Penalties for $5.55 Million - August 4, 2016Multiple alleged HIPAA violations result in $2.75 million settlement with the University of Mississippi Medical Center (UMMC) - July 21, 2016Widespread HIPAA vulnerabilities result in $2.7 million settlement with Oregon Health & Science University - July 18, 2016Business Associate’s Failure to Safeguard Nursing Home Residents’ PHI Leads to $650,000 HIPAA Settlement - June 29, 2016HHS Guidance Regarding Patient Safety Work Product and Providers’ External Obligations -June 23, 2016Clarification of Permissible Fees for HIPAA Right of Access - Flat Rate Option Up to $6.50 is Not a Cap on All Fees for Copies of PHI - May 23, 2016Unauthorized Filming for "NY Med" Results in $2.2 Million Settlement with New York Presbyterian Hospital - April 21, 2016$750,000 settlement highlights the need for HIPAA business associate agreements - April 19, 2016OCR Launches Phase 2 of HIPAA Audit Program - March 21, 2016Improper disclosure of research participants’ protected health information results in $3.9 million HIPAA settlement - March 17, 2016$1.55 million settlement underscores the importance of executing HIPAA business associate agreements - March 16, 2016New HIPAA Guidance Reiterates Patients’ Right to Access Health Information and Clarifies Appropriate Fees for Copies - February 25, 2016Addressing Gaps in Cybersecurity: OCR Releases Crosswalk Between HIPAA Security Rule and NIST Cybersecurity Framework - 02/24/2016Physical therapy provider settles violations that it impermissibly disclosed patient information - 02/16/2016Administrative Law Judge rules in favor of OCR enforcement, requiring Lincare, Inc. to pay $239,800 - 02/03/2016Individuals’ Right Under HIPAA to Access their Health Information - 01/07/2016OCR Launches Redesigned Website**Obama Administration Modifies HIPAA to Strengthen the Firearm Background Check System - 01/04/2016**Read the Blog PostRead the NICS Final Rule$750,000 HIPAA Settlement Underscores the Need for Organization Wide Risk Analysis - 12/14/2015Triple-S Management Corporation Settles HHS Charges by Agreeing to $3.5 Million HIPAA Settlement - 11/30/2015HIPAA Settlement Reinforces Lessons for Users of Medical Devices - 11/25/2015OCR Invites Developers to Ask Questions about HIPAA Privacy and Security - 10/5/2015$750,000 HIPAA Settlement Emphasizes the Importance of Risk Analysis and Device and Media Control Policies - 9/2/2014HIPAA Settlement Highlights Importance of Safeguards When Using Internet Applications - 7/10/2015HIPAA Settlement Highlights the Continuing Importance of Secure Disposal of Paper Medical Records - 4/30/2015NEW Guidance on HIPAA and Workplace Wellness Programs - 4/16/15Version 2.0 of the *Guide to Privacy and Security of Electronic Health Information* released. - PDF - 4/13/2015Read the blog post
                        Frequently Requested Information        





Report to Congress on Privacy Rule and Security RuleReport to Congress on Breach NotificationList of breaches over 500Enforcement DataFrequently Asked Questions - Health Information PrivacyFrequently Asked Questions - Civil RightsRequest a Speaker from OCRTweets by @HHSOCR
  
  Join the ConversationFrequently Requested Information

Report to Congress on Privacy Rule and Security Rule
	Report to Congress on Breach Notification
	List of breaches over 500
	Enforcement Data
	Frequently Asked Questions - Health Information Privacy
	Frequently Asked Questions - Civil Rights
	Request a Speaker from OCR

                    
  


Content created by Office for Civil Rights (OCR) Content last reviewed April 10, 2024Back to top
    Contact HHS
    
                        
                                            
      
      
      Careers
    
                        
                                            
      
      
      HHS FAQs
    
                        
                                            
      
      
      Nondiscrimination NoticeHHS Archive
    
                        
                                            
      
      
      Accessibility
    
                        
                                            
      
      
      Privacy Policy
    
                        
                                            
      
      
      Viewers & PlayersBudget/Performance
    
                        
                                            
      
      
      Inspector General
    
                        
                                            
      
      
      Web Site Disclaimers
    
                        
                                            
      
      
      EEO/No Fear ActFOIA
    
                        
                                            
      
      
      The White House
    
                        
                                            
      
      
      USA.gov
    
                        
                                            
      
      
      Vulnerability Disclosure Policy
        Sign Up for Email Updates

Receive the latest updates from the Secretary, Blogs, and News Releases.

Sign Up
  HHS Headquarters
          200 Independence Avenue, S.W.
                  Washington, D.C. 20201
                  Toll Free Call Center: 1-877-696-6775​