# OCR Resolution Agreements Index — Verbatim Snapshot Dataset

Retrieved: 2026-04-28

Source URL:
- https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html

Notes:
- Captured from browser accessibility snapshot to preserve visible text and linked URLs.
- Includes a long list of historical OCR settlements, resolution agreements, and CMP notices.

## Resolution Agreements Page Snapshot

```text
Page Title: Resolution Agreements | HHS.gov
URL: https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html
Snapshot:
- generic [active] [ref=e1]:
- link "Skip to main content" [ref=e2] [cursor=pointer]:
- /url: "#main"
- generic [ref=e4]:
- region "Official government website" [ref=e5]:
- generic [ref=e8]:
- img "U.S. flag" [ref=e10]
- paragraph [ref=e12]: An official website of the United States government
- button "Here’s how you know" [ref=e13] [cursor=pointer]
- generic [ref=e19]:
- img "Freedom 250 banner logo" [ref=e20]
- link "Join HHS in Celebrating Freedom 250" [ref=e21] [cursor=pointer]:
- /url: /freedom250/index.html
- img [ref=e22]
- banner [ref=e24]:
- generic [ref=e25]:
- link "Home" [ref=e28] [cursor=pointer]:
- /url: /
- img [ref=e29]
- button "Menu" [ref=e115]
- generic [ref=e118]:
- navigation "breadcrumb-label-1213176406" [ref=e120]:
- generic [ref=e122]:
- generic [ref=e123]: Breadcrumb
- list [ref=e124]:
- listitem [ref=e125]:
- link "HHS" [ref=e126] [cursor=pointer]:
- /url: /
- listitem [ref=e127]:
- link "HIPAA Home" [ref=e128] [cursor=pointer]:
- /url: /hipaa/index.html
- listitem [ref=e129]:
- link "For Professionals" [ref=e130] [cursor=pointer]:
- /url: /hipaa/for-professionals/index.html
- listitem [ref=e131]:
- link "HIPAA Compliance and Enforcement" [ref=e132] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/index.html
- listitem [ref=e133]: Resolution Agreements
- list [ref=e137]:
- listitem [ref=e138]:
- checkbox "Adjust Text Size" [ref=e139] [cursor=pointer]:
- img [ref=e140]
- listitem [ref=e141]:
- link "Print" [ref=e142] [cursor=pointer]:
- /url: "#"
- img [ref=e143]
- listitem [ref=e145]:
- button "Page sharing options" [ref=e146] [cursor=pointer]:
- img [ref=e147]
- generic [ref=e149]: Page sharing options
- main [ref=e150]:
- generic [ref=e154]:
- complementary [ref=e155]:
- button "Navigate to:" [ref=e158] [cursor=pointer]
- generic [ref=e159]:
- generic [ref=e162]:
- heading "Resolution Agreements" [level=1] [ref=e163]
- article [ref=e164]:
- generic [ref=e169]:
- heading "Resolution Agreements and Civil Money Penalties" [level=2] [ref=e170]
- paragraph [ref=e171]: A resolution agreement is a settlement agreement signed by HHS and a covered entity or business associate in which the covered entity or business associate agrees to perform certain obligations and make reports to HHS, generally for a period of three years. During the period, HHS monitors the covered entity’s compliance with its obligations. A resolution agreement may include the payment of a resolution amount. If HHS cannot reach a satisfactory resolution through the covered entity’s demonstrated compliance or corrective action through other informal means, including a resolution agreement, civil money penalties (CMPs) may be imposed for noncompliance against a covered entity.
- list [ref=e172]:
- listitem [ref=e173]:
- link "HHS’ Office for Civil Rights Settles HIPAA Investigation of MMG Fusion, LLC Breach , opens in a new tab" [ref=e175] [cursor=pointer]:
- /url: /sites/default/files/ocr-mmg-fusion-hipaa-agreement.pdf
- text: HHS’ Office for Civil Rights Settles HIPAA Investigation of MMG Fusion, LLC Breach
- generic [ref=e176]: ", opens in a new tab"
- text: "- March 5, 2026"
- listitem [ref=e177]:
- paragraph [ref=e178]:
- link "HHS’ Office for Civil Rights Settles HIPAA Ransomware Security Rule Investigation with BST & Co. CPAs, LLP , opens in a new tab" [ref=e180] [cursor=pointer]:
- /url: /sites/default/files/hhs-ocr-bst-hipaa-settlement.pdf
- text: HHS’ Office for Civil Rights Settles HIPAA Ransomware Security Rule Investigation with BST & Co. CPAs, LLP
- generic [ref=e181]: ", opens in a new tab"
- text: "- August 18, 2025"
- listitem [ref=e182]:
- link "HHS’ Office for Civil Rights Settles HIPAA Ransomware Investigation with Syracuse ASC , opens in a new tab" [ref=e184] [cursor=pointer]:
- /url: /sites/default/files/ocr-hipaa-racap-syracuse-asc.pdf
- text: HHS’ Office for Civil Rights Settles HIPAA Ransomware Investigation with Syracuse ASC
- generic [ref=e185]: ", opens in a new tab"
- text: "- July 23, 2025"
- listitem [ref=e186]:
- link "HHS’ Office for Civil Rights Settles HIPAA Privacy and Security Rule Investigation with a Behavioral Health Provider , opens in a new tab" [ref=e188] [cursor=pointer]:
- /url: /sites/default/files/ocr-hipaa-racap-deer-oaks.pdf
- text: HHS’ Office for Civil Rights Settles HIPAA Privacy and Security Rule Investigation with a Behavioral Health Provider
- generic [ref=e189]: ", opens in a new tab"
- text: "- July 7, 2025"
- listitem [ref=e190]:
- link "HHS Office for Civil Rights Settles HIPAA Ransomware Cybersecurity Investigation with Comstar, LLC" [ref=e191] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/hhs-hipaa-agreement-comstar/index.html
- text: "- May 30, 2025"
- listitem [ref=e192]:
- link "HHS Office for Civil Rights Settles HIPAA Security Rule Investigation with a Florida Health Care Provider , opens in a new tab" [ref=e194] [cursor=pointer]:
- /url: /sites/default/files/hhs-ocr-hipaa-baycare-agreement.pdf
- text: HHS Office for Civil Rights Settles HIPAA Security Rule Investigation with a Florida Health Care Provider
- generic [ref=e195]: ", opens in a new tab"
- text: "- May 28, 2025"
- listitem [ref=e196]:
- link "HHS Office for Civil Rights Settles HIPAA Cybersecurity Investigation with Vision Upright MRI" [ref=e197] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/hhs-ocr-hipaa-racap-vum/index.html
- text: "- May 15, 2025"
- listitem [ref=e198]:
- link "HHS Office for Civil Rights Settles HIPAA Ransomware Cybersecurity Investigation with Neurology Practice , opens in a new tab" [ref=e200] [cursor=pointer]:
- /url: /sites/default/files/ocr-hipaa-racap-np.pdf
- text: HHS Office for Civil Rights Settles HIPAA Ransomware Cybersecurity Investigation with Neurology Practice
- generic [ref=e201]: ", opens in a new tab"
- text: "- April 25, 2025"
- listitem [ref=e202]:
- link "HHS Office for Civil Rights Settles Phishing Attack Breach with Health Care Network for $600,000 , opens in a new tab" [ref=e204] [cursor=pointer]:
- /url: /sites/default/files/ocr-hipaa-racap-pih.pdf
- text: HHS Office for Civil Rights Settles Phishing Attack Breach with Health Care Network for $600,000
- generic [ref=e205]: ", opens in a new tab"
- text: "- April 23, 2025"
- listitem [ref=e206]:
- link "HHS Office for Civil Rights Settles HIPAA Ransomware Cybersecurity Investigation with Public Hospital , opens in a new tab" [ref=e208] [cursor=pointer]:
- /url: /sites/default/files/ocr-hipaa-recap-gmha.pdf
- text: HHS Office for Civil Rights Settles HIPAA Ransomware Cybersecurity Investigation with Public Hospital
- generic [ref=e209]: ", opens in a new tab"
- text: "- April 17, 2025"
- listitem [ref=e210]:
- link "HHS Office for Civil Rights Settles HIPAA Security Rule Investigation with Northeast Radiology , opens in a new tab" [ref=e212] [cursor=pointer]:
- /url: /sites/default/files/ocr-hipaa-settlement-nerad.pdf
- text: HHS Office for Civil Rights Settles HIPAA Security Rule Investigation with Northeast Radiology
- generic [ref=e213]: ", opens in a new tab"
- text: "- April 4, 2025"
- listitem [ref=e214]:
- link "HHS’ Office for Civil Rights Settles HIPAA Security Rule Investigation with Health Fitness Corporation , opens in a new tab" [ref=e216] [cursor=pointer]:
- /url: /sites/default/files/ocr-health-fitness-ra-cap.pdf
- text: HHS’ Office for Civil Rights Settles HIPAA Security Rule Investigation with Health Fitness Corporation
- generic [ref=e217]: ", opens in a new tab"
- text: "- March 21, 2025"
- listitem [ref=e218]:
- link "HHS Office for Civil Rights Imposes a $200,000 Penalty Against Oregon Health & Science University for Failure to Provide Timely Access to Patient Records" [ref=e219] [cursor=pointer]:
- /url: /about/news/2025/03/06/hhs-office-civil-rights-imposes-200000-penalty-against-oregon-health-science-university-failure-provide-timely-access-patient-records.html
- text: "- March 6, 2025"
- listitem [ref=e220]:
- link "HHS Office for Civil Rights Imposes a $1,500,000 Civil Money Penalty Against Warby Parker in HIPAA Cybersecurity Hacking Investigation" [ref=e221] [cursor=pointer]:
- /url: /about/news/2025/02/20/hhs-imposes-1500000-penalty-against-warby-parker-hipaa-hacking.html
- text: "- February 20, 2025"
- listitem [ref=e222]:
- link "HHS Office for Civil Rights Settles HIPAA Ransomware Cybersecurity Investigation for $10,000" [ref=e223] [cursor=pointer]:
- /url: /about/news/2025/01/15/hhs-office-civil-rights-settles-hipaa-ransomware-cybersecurity-investigation-northeast-surgical-group.html
- text: "- January 15, 2025"
- listitem [ref=e224]:
- link "HHS Office for Civil Rights Settles HIPAA Case Against Memorial Healthcare System Over Patient Access to Records" [ref=e225] [cursor=pointer]:
- /url: /about/news/2025/01/15/hhs-office-civil-rights-settles-hipaa-case-against-memorial-healthcare-system-over-patient-access-records.html
- text: "- January 15, 2025"
- listitem [ref=e226]:
- link "HHS Office for Civil Rights Settles HIPAA Phishing Cybersecurity Investigation with Solara Medical Supplies, LLC for $3,000,000" [ref=e227] [cursor=pointer]:
- /url: /about/news/2025/01/14/hhs-office-civil-rights-settles-hipaa-phishing-cybersecurity-investigation-solara-medical-supplies-3000000.html
- text: "- January 14, 2025"
- listitem [ref=e228]:
- link "HHS Office for Civil Rights Settles HIPAA Security Rule Investigation with USR Holdings, LLC Concerning the Deletion of Electronic Protected Health Information" [ref=e229] [cursor=pointer]:
- /url: /about/news/2025/01/08/hhs-office-civil-rights-settles-hipaa-security-rule-investigation-usr-holdings-llc-concerning-deletion-electronic-protected-health-information.html
- text: "- January 8, 2025"
- listitem [ref=e230]:
- link "HHS Office for Civil Rights Settles 9th Ransomware Investigation with Virtual Private Network Solutions" [ref=e231] [cursor=pointer]:
- /url: /about/news/2025/01/07/hhs-office-civil-rights-settles-9th-ransomware-investigation-virtual-private-network-solutions.html
- text: "- January 7, 2025"
- listitem [ref=e232]:
- link "HHS Office for Civil Rights Settles 8th Ransomware Investigation with Elgon Information Systems" [ref=e233] [cursor=pointer]:
- /url: /about/news/2025/01/07/hhs-office-civil-rights-settles-8th-ransomware-investigation-elgon-information-systems.html
- text: "- January 7, 2025"
- listitem [ref=e234]:
- link "HHS Office for Civil Rights Settles with Health Care Clearinghouse, Inmediata Health Group, Over HIPAA Impermissible Disclosure" [ref=e235] [cursor=pointer]:
- /url: /about/news/2024/12/10/hhs-office-civil-rights-settles-health-care-clearinghouse-inmediata-health-group-hipaa-impermissible-disclosure.html
- text: "- December 10, 2024"
- listitem [ref=e236]:
- link "HHS Office for Civil Rights Imposes a $548,265 Penalty Against Children’s Hospital Colorado for HIPAA Privacy and Security Rules Violations" [ref=e237] [cursor=pointer]:
- /url: /about/news/2024/12/05/hhs-ocr-imposes-548-265-penalty-against-childrens-hospital-colorado-hipaa-privacy-security-rules-violations.html
- text: "- December 5, 2024"
- listitem [ref=e238]:
- link "HHS Office for Civil Rights Imposes a $1.19 Million Penalty Against Gulf Coast Pain Consultants for HIPAA Security Rule Violations" [ref=e239] [cursor=pointer]:
- /url: /about/news/2024/12/03/hhs-ocr-imposes-penalty-against-gulf-coast-pain-consultants.html
- text: "- December 3, 2024"
- listitem [ref=e240]:
- link "HHS Office for Civil Rights Settles with Holy Redeemer Family Medicine Over Disclosure of Patient’s Protected Health Information, Including Reproductive Health Information" [ref=e241] [cursor=pointer]:
- /url: /about/news/2024/11/26/hhs-office-civil-rights-settles-holy-redeemer-hospital-disclosure-patients-protected-health-information-including-reproductive-health-information.html
- text: "- November 26, 2024"
- listitem [ref=e242]:
- link "HHS Office for Civil Rights Imposes a $100,000 Penalty Against Mental Health Center for Failure to Provide Timely Access to Patient Records" [ref=e243] [cursor=pointer]:
- /url: /about/news/2024/11/19/hhs-office-civil-rights-imposes-penalty-mental-health-center-failure-provide-timely-access-patient-records.html
- text: "- November 19, 2024"
- listitem [ref=e244]:
- link "HHS Office for Civil Rights Settles HIPAA Ransomware Cybersecurity Investigation for $90,000" [ref=e245] [cursor=pointer]:
- /url: /about/news/2024/10/31/hhs-office-for-civil-rights-settles-hipaa-ransomware-cybersecurity-investigation-for-90000-dollars.html
- text: "- October 31, 2024"
- listitem [ref=e246]:
- link "HHS Office for Civil Rights Settles Ransomware Cybersecurity Investigation for $500,000" [ref=e247] [cursor=pointer]:
- /url: /about/news/2024/10/31/hhs-office-civil-rights-settles-ransomware-cybersecurity-investigation-500000.html
- text: "- October 31, 2024"
- listitem [ref=e248]:
- link "HHS Office for Civil Rights Imposes a $70,000 Civil Monetary Penalty Against Gums Dental Care for Failure to Provide Timely Access to Patient Records" [ref=e249] [cursor=pointer]:
- /url: /about/news/2024/10/17/hhs-office-civil-rights-imposes-70000-civil-monetary-penalty-against-gums-dental-care-failure-provide-timely-access-patient-records.html
- text: "- October 17, 2024"
- listitem [ref=e250]:
- link "HHS Office for Civil Rights Imposes a $240,000 Civil Monetary Penalty Against Providence Medical Institute in HIPAA Ransomware Cybersecurity Investigation" [ref=e251] [cursor=pointer]:
- /url: /about/news/2024/10/03/hhs-ocr-imposes-civil-monetary-penalty-against-providence-medical-institute-hipaa-ransomware-cybersecurity-investigation.html
- text: "- October 3, 2024"
- listitem [ref=e252]:
- link "HHS Office for Civil Rights Settles Ransomware Cybersecurity Investigation under HIPAA Security Rule for $250,000" [ref=e253] [cursor=pointer]:
- /url: /about/news/2024/09/26/hhs-office-civil-rights-settles-ransomware-cybersecurity-investigation-under-hipaa-security-rule-250-000.html
- text: "- September 26, 2024"
- listitem [ref=e254]:
- link "HHS Office for Civil Rights Settles HIPAA Security Rule Failures for $950,000" [ref=e255] [cursor=pointer]:
- /url: /about/news/2024/07/01/hhs-office-civil-rights-settles-hipaa-security-rule-failures-950000.html
- text: – July 1, 2024
- listitem [ref=e256]:
- link "HHS OCR Imposes a CMP on NJ Nursing Facility for Failing to Provide Timely Access to Patient Records" [ref=e257] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/hackensack-meridian-health-west-caldwell-care-center/index.html#nfd
- text: "- April 1, 2024"
- listitem [ref=e258]:
- link "HHS’ OCR Settles HIPAA Investigation with Phoenix Healthcare" [ref=e259] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/phoenix-healthcare/index.html
- text: "- March 29, 2024"
- listitem [ref=e260]:
- link "HHS OCR Work with Hospital to Improve Access to Kosher Electronic Devices Use for Virtual Patient Visitation" [ref=e261] [cursor=pointer]:
- /url: https://www.hhs.gov/about/news/2024/03/05/hhs-office-civil-rights-works-hospital-improve-access-kosher-electronic-devices-used-virtual-patient-visitation.html
- text: "- March 5, 2024"
- listitem [ref=e262]:
- link "HHS Finalizes New Provisions to Enhance Integrated Care and Confidentiality for Patients with Substance Use Conditions" [ref=e263] [cursor=pointer]:
- /url: /hipaa/for-professionals/regulatory-initiatives/fact-sheet-42-cfr-part-2-final-rule/index.html
- text: – February 8, 2024
- listitem [ref=e264]:
- link "HHS’ Office for Civil Rights Settles Malicious Insider Cybersecurity Investigation for $4.75 Million" [ref=e265] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/montiefore/index.html
- text: "- February 6, 2024"
- listitem [ref=e266]:
- link "Voluntary Resolution Agreement Between The United States Department of Health and Human Services, Office for Civil Rights (“HHS”) and Montiefore" [ref=e267] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/montiefore/index.html
- text: – November 16, 2023
- listitem [ref=e268]:
- link "HHS’ Office for Civil Rights Settles Optum Medical Care" [ref=e269] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/optum-medical-care.html
- text: "- November 15, 2023"
- listitem [ref=e270]:
- link "HHS’ Office for Civil Rights Settles HIPAA Investigation of St. Joseph’s Medical Center for Disclosure of Patients’ Protected Health Information to a News Reporter" [ref=e271] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/sjmc-ra-cap/index.html
- text: "- November 20, 2023"
- listitem [ref=e272]:
- link "HHS’ Office for Civil Rights Settles Ransomware Cyber-Attack Investigation with Doctors’ Management Services" [ref=e273] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/dms-ra-cap/index.html
- text: "- October 31, 2023"
- listitem [ref=e274]:
- link "Green Ridge Behavioral Health, LLC Resolution Agreement and Corrective Action Plan" [ref=e275] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/green-ridge-behavioral-health-ra-cap/index.html
- text: "- October 30, 2023"
- listitem [ref=e276]:
- link "HHS Office for Civil Rights Settles with L.A. Care Health Plan Over Potential HIPAA Security Rule Violations" [ref=e277] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/la-care-health-plan/index.html
- text: "- September 11, 2023"
- listitem [ref=e278]:
- link "Voluntary Resolution Agreement Between The United States Department of Health and Human Services, Office for Civil Rights (“HHS”) and UnitedHealthcare Insurance Company" [ref=e279] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/uhc-ra-cap/index.html
- text: – August 24, 2023
- listitem [ref=e280]:
- link "HHS Office for Civil Rights Settles HIPAA Investigation with iHealth Solutions Regarding Disclosure of Protected Health Information on an Unsecured Server for $75,000" [ref=e281] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/ihealth-ra-cap/index.html
- text: – June 28, 2023
- listitem [ref=e282]:
- link "Snooping in Medical Records by Hospital Security Guards Leads to $240,000 HIPAA Settlement" [ref=e283] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/yakima-ra-cap/index.html
- text: – June 15, 2023
- listitem [ref=e284]:
- link "HHS Office for Civil Rights Reaches Agreement with Health Care Provider in New Jersey That Disclosed Patient Information in Response to Negative Online Reviews" [ref=e285] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/manasa-ra-cap/index.html
- text: – June 5, 2023
- listitem [ref=e286]:
- link "HHS Office for Civil Rights Settles HIPAA Investigation with Arkansas Business Associate MedEvolve Following Unlawful Disclosure of Protected Health Information on an Unsecured Server for $350,000" [ref=e287] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/medevolve-ra-cap/index.html
- text: – May 16, 2023
- listitem [ref=e288]:
- link "HHS Office for Civil Rights Enters Into $15,000 Settlement Resolving Potential HIPAA Violation Under the Right of Access Initiative" [ref=e289] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/mente-ra-cap/index.html
- text: – May 8, 2023
- listitem [ref=e290]:
- link "HHS Office for Civil Rights Settles HIPAA Investigation with Arizona Hospital System Following Cybersecurity Hacking" [ref=e291] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/banner-health/index.html
- text: "- February 2, 2023"
- listitem [ref=e292]:
- link "Lab Pays $16,500 Settlement to HHS, Resolving Potential HIPAA Violation over Medical Records Request" [ref=e293] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/life-hopes-ra-cap/index.html
- text: "- January 3, 2023"
- listitem [ref=e294]:
- link "HHS Civil Rights Office Resolves HIPAA Right of Access Investigation with $20,000 Settlement" [ref=e295] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/health-specialists-ra-cap/index.html
- text: "- December 15, 2022"
- listitem [ref=e296]:
- link "HHS Civil Rights Office Enters Settlement with Dental Practice Over Disclosures of Patients’ Protected Health Information" [ref=e297] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/new-vision-ra-cap/index.html
- text: "- December 14, 2022"
- listitem [ref=e298]:
- link "OCR Settles Three Cases with Dental Practices for Patient Right of Access under HIPAA" [ref=e299] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/september-2022-right-of-access-initiative/index.html
- text: "- September 20, 2022"
- listitem [ref=e300]:
- link "OCR Settles Case Concerning Improper Disposal of Protected Health Information" [ref=e301] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/nedlc-ra-cap/index.html
- text: "- August 23, 2022"
- list [ref=e302]:
- listitem [ref=e303]:
- link "Read OCR's FAQs concerning HIPAA and the disposal of protected health information , opens in a new tab" [ref=e305] [cursor=pointer]:
- /url: /sites/default/files/disposalfaqs.pdf
- text: Read OCR's FAQs concerning HIPAA and the disposal of protected health information
- generic [ref=e306]: ", opens in a new tab"
- listitem [ref=e307]:
- link "Eleven Enforcement Actions Uphold Patients’ Rights Under HIPAA" [ref=e308] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/july-2022-hipaa-enforcement/index.html
- text: "- July 15, 2022"
- listitem [ref=e309]:
- link "Oklahoma State University - Center for Health Services Pays $875,000 to Settle Hacking Breach" [ref=e310] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/osu/index.html
- text: "- July 14, 2022"
- listitem [ref=e311]:
- link "Four HIPAA enforcement actions hold healthcare providers accountable with compliance" [ref=e312] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/march-2022-hipaa-enforcement/index.html
- text: "- March 28, 2022"
- listitem [ref=e313]:
- link "Five enforcement actions hold healthcare providers accountable for HIPAA Right of Access" [ref=e314] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/2021-right-of-access-initiative/index.html
- text: "- November 30, 2021"
- listitem [ref=e315]:
- link "OCR Resolves Twentieth Investigation in HIPAA Right of Access Initiative with $80,000 Settlement" [ref=e316] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/chmc/index.html
- text: "- September 10, 2021"
- listitem [ref=e317]:
- link "OCR Settles Nineteenth Investigation in HIPAA Right of Access Initiative" [ref=e318] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/delc/index.html
- text: "- June 2, 2021"
- listitem [ref=e319]:
- link "Clinical Laboratory Pays $25,000 to Settle Potential HIPAA Security Rule Violations" [ref=e320] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/peachstate/index.html
- text: "- May 25, 2021"
- listitem [ref=e321]:
- link "OCR Settles Eighteenth Investigation in HIPAA Right of Access Initiative" [ref=e322] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/vps/index.html
- text: "- March 26, 2021"
- listitem [ref=e323]:
- link "OCR Settles Seventeenth Investigation in HIPAA Right of Access Initiative" [ref=e324] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/arbour/index.html
- text: "- March 24, 2021"
- listitem [ref=e325]:
- link "OCR Settles Sixteenth Investigation in HIPAA Right of Access Initiative" [ref=e326] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/sharp/index.html
- text: "- February 12, 2021"
- listitem [ref=e327]:
- link "OCR Settles Fifteenth Investigation in HIPAA Right of Access Initiative" [ref=e328] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/renown/index.html
- text: "- February 10, 2021"
- listitem [ref=e329]:
- link "Health Insurer Pays $5.1 Million to Settle Data Breach Affecting Over 9.3 Million People" [ref=e330] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/excellus/index.html
- text: "- January 15, 2021"
- listitem [ref=e331]:
- link "OCR Settles Fourteenth Investigation in HIPAA Right of Access Initiative" [ref=e332] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/banner/index.html
- text: "- January 12, 2021"
- listitem [ref=e333]:
- link "OCR Settles Thirteenth Investigation in HIPAA Right of Access Initiative" [ref=e334] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/elite-primary-care/index.html
- text: "- December 22, 2020"
- listitem [ref=e335]:
- link "OCR Settles Twelfth Investigation in HIPAA Right of Access Initiative" [ref=e336] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/ucmc/index.html
- text: "- November 19, 2020"
- listitem [ref=e337]:
- link "OCR Settles Eleventh Investigation in HIPAA Right of Access Initiative" [ref=e338] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/bhayani/index.html
- text: "- November 12, 2020"
- listitem [ref=e339]:
- link "OCR Settles Tenth Investigation in HIPAA Right of Access Initiative" [ref=e340] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/riverside/index.html
- text: "- November 6, 2020"
- listitem [ref=e341]:
- link "City Health Department failed to terminate former employee’s access to protected health information" [ref=e342] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/new-haven/index.html
- text: "- October 30, 2020"
- listitem [ref=e343]:
- link "Aetna Pays $1,000,000 to Settle Three HIPAA Breaches" [ref=e344] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/aetna/index.html
- text: "- October 28, 2020"
- listitem [ref=e345]:
- link "OCR Settles Ninth Investigation in HIPAA Right of Access Initiative" [ref=e346] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/nyspine/index.html
- text: "- October 9, 2020"
- listitem [ref=e347]:
- link "OCR Settles Eighth Investigation in HIPAA Right of Access Initiative" [ref=e348] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/sjhmc/index.html
- text: "- October 7, 2020"
- listitem [ref=e349]:
- link "Health Insurer Pays $6.85 Million to Settle Data Breach Affecting Over 10.4 Million People" [ref=e350] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/premera/index.html
- text: "- September 25, 2020"
- listitem [ref=e351]:
- link "HIPAA Business Associate Pays $2.3 Million to Settle Breach Affecting Protected Health Information of Over 6 million Individual" [ref=e352] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/chspsc/index.html
- text: "- September 23, 2020"
- listitem [ref=e353]:
- link "Orthopedic Clinic Pays $1.5 Million to Settle Systemic Noncompliance with HIPAA Rules" [ref=e354] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/athens-orthopedic/index.html
- text: "- September 21, 2020"
- listitem [ref=e355]:
- link "OCR Settles Five More Investigations in HIPAA Right of Access Initiative" [ref=e356] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/right-of-access-initiative/index.html
- text: "- September 15, 2020"
- listitem [ref=e357]:
- link "Lifespan Pays $1,040,000 to OCR to Settle Unencrypted Stolen Laptop Breach" [ref=e358] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/lifespan/index.html
- text: "- July 27, 2020"
- listitem [ref=e359]:
- link "Small Health Care Provider Fails to Implement Multiple HIPAA Security Rule Requirements" [ref=e360] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/metro/index.html
- text: – July 23, 2020
- listitem [ref=e361]:
- link "Health Care Provider Pays $100,000 Settlement to OCR for Failing to Implement HIPAA Security Rule Requirements" [ref=e362] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/porter/index.html
- text: "- March 3, 2020"
- listitem [ref=e363]:
- link "Ambulance Company Pays $65,000 to Settle Allegations of Longstanding HIPAA Noncompliance" [ref=e364] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/westgeorgia/index.html
- text: "- December 30, 2019"
- listitem [ref=e365]:
- link "OCR Settles Second Case in HIPAA Right of Access Initiative" [ref=e366] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/korunda/index.html
- text: "- December 12, 2019"
- listitem [ref=e367]:
- link "OCR Secures $2.175 Million HIPAA Settlement After Hospitals Failed to Properly Notify HHS of a Breach of Unsecured Protected Health Information" [ref=e368] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/sentara/index.html
- text: "- November 26, 2019"
- listitem [ref=e369]:
- link "OCR Imposes a $1.6 Million Civil Money Penalty against Texas Health and Human Services Commission for HIPAA Violations" [ref=e370] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/txhhsc/index.html
- text: "- November 7, 2019"
- listitem [ref=e371]:
- link "Failure to Encrypt Mobile Devices Leads to $3 Million HIPAA Settlement" [ref=e372] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/urmc/index.html
- text: "- November 5, 2019"
- listitem [ref=e373]:
- link "OCR Imposes a $2.15 Million Civil Money Penalty against Jackson Health System for HIPAA Violations" [ref=e374] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/jackson/index.html
- text: "- October 23, 2019"
- listitem [ref=e375]:
- link "Dental Practice Pays $10,000 to Settle Social Media Disclosures of Patients’ Protected Health Information" [ref=e376] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/elite/index.html
- text: "- October 2, 2019"
- listitem [ref=e377]:
- link "OCR Settles First Case in HIPAA Right of Access Initiative" [ref=e378] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/bayfront/index.html
- text: "- September 9, 2019"
- listitem [ref=e379]:
- link "Indiana Medical Records Service Pays $100,000 to Settle HIPAA Breach" [ref=e380] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/mie/index.html
- text: "- May 23, 2019"
- listitem [ref=e381]:
- link "Tennessee Diagnostic Medical Imaging Services Company Pays $3,000,000 to Settle Breach Exposing Over 300,000 Patients' Protected Health Information" [ref=e382] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/tmi/index.html
- text: "- May 6, 2019"
- listitem [ref=e383]:
- link "OCR Concludes 2018 with All-Time Record Year for HIPAA Enforcement" [ref=e384] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/2018enforcement/index.html
- text: "- February7, 2019"
- listitem [ref=e385]:
- link "Cottage Health Settles Potential Violations of HIPAA Rules for $3 Million" [ref=e386] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/cottage/index.html
- text: "- February 7, 2019"
- listitem [ref=e387]:
- link "Colorado hospital failed to terminate former employee’s access to electronic protected health information" [ref=e388] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/pagosasprings/index.html
- text: "- December 11, 2018"
- listitem [ref=e389]:
- link "Florida contractor physicians' group shares protected health information with unknown vendor without a business associate agreement" [ref=e390] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/ach/index.html
- text: "- December 4, 2018"
- listitem [ref=e391]:
- link "Allergy Practice pays $125,000 to settle doctor's disclosure of patient information to a reporter" [ref=e392] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/allergyassociates/index.html
- text: "- November 26, 2018"
- listitem [ref=e393]:
- link "Anthem pays OCR $16 Million in record HIPAA settlement following largest health data breach in history" [ref=e394] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/anthem/index.html
- text: – October 15, 2018
- listitem [ref=e395]:
- link "Unauthorized Disclosure of Patients’ Protected Health Information During ABC Documentary Filming Results in Multiple HIPAA Settlements Totaling $999,000" [ref=e396] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/bostoncases/index.html
- text: – September 20, 2018
- listitem [ref=e397]:
- link "Judge rules in favor of OCR and requires a Texas cancer center to pay $4.3 million in penalties for HIPAA violations" [ref=e398] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/mdanderson/index.html
- text: "- June 18, 2018"
- listitem [ref=e399]:
- link "Consequences for HIPAA violations don’t stop when a business closes" [ref=e400] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/filefax/index.html
- text: "- February 13, 2018"
- listitem [ref=e401]:
- link "Five breaches add up to millions in settlement costs for entity that failed to heed HIPAA’s risk analysis and risk management rules" [ref=e402] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/fmcna/index.html
- text: "- February 1, 2018"
- listitem [ref=e403]:
- link "Failure to protect the health records of millions of people costs entity millions of dollars" [ref=e404] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/21CO/index.html
- text: "- December 28, 2017"
- listitem [ref=e405]:
- link "Careless handling of HIV information jeopardizes patient’s privacy, costs entity $387k" [ref=e406] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/stlukes/index.html
- text: "- May 23, 2017"
- listitem [ref=e407]:
- link "Texas health system settles potential HIPAA violations for disclosing patient information" [ref=e408] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/MHHS/index.html
- text: "- May 10, 2017"
- listitem [ref=e409]:
- link "$2.5 million settlement shows that not understanding HIPAA requirements creates risk" [ref=e410] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/cardionet/index.html
- text: "- April 24, 2017"
- listitem [ref=e411]:
- link "No Business Associate Agreement? $31K Mistake" [ref=e412] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/ccdh/index.html
- text: "- April 20, 2017"
- listitem [ref=e413]:
- link "Overlooking risks leads to breach, $400,000 settlement" [ref=e414] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/MCPN.html
- text: "- April 12, 2017"
- listitem [ref=e415]:
- link "$5.5 million HIPAA settlement shines light on the importance of audit controls" [ref=e416] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/memorial/index.html
- text: "- February 16, 2017"
- listitem [ref=e417]:
- link "Lack of timely action risks security and costs money" [ref=e418] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/childrens/index.html
- text: "- February 1, 2017"
- listitem [ref=e419]:
- link "HIPAA settlement demonstrates importance of implementing safeguards for ePHI" [ref=e420] [cursor=pointer]:
- /url: /about/news/2017/01/18/hipaa-settlement-demonstrates-importance-implementing-safeguards-ephi.html
- text: "- January 18, 2017"
- listitem [ref=e421]:
- link "First HIPAA enforcement action for lack of timely breach notification settles for $475,000" [ref=e422] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/presence/index.html
- text: "- January 9, 2017"
- listitem [ref=e423]:
- link "UMass settles potential HIPAA violations following malware infection" [ref=e424] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/umass/index.html
- text: "- November 22, 2016"
- listitem [ref=e425]:
- link "$2.14 million HIPAA settlement underscores importance of managing security risk" [ref=e426] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/sjh/index.html
- text: "- October 17, 2016"
- listitem [ref=e427]:
- link "HIPAA settlement illustrates the importance of reviewing and updating, as necessary, business associate agreements" [ref=e428] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/wih/index.html
- text: "- September 23, 2016"
- listitem [ref=e429]:
- link "Advocate Health Care Settles Potential HIPAA Penalties for $5.55 Million" [ref=e430] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/ahcn/index.html
- text: "- August 4, 2016"
- listitem [ref=e431]:
- link "Multiple alleged HIPAA violations result in $2.75 million settlement with the University of Mississippi Medical Center (UMMC)" [ref=e432] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/UMMC/index.html
- text: "- July 21, 2016"
- listitem [ref=e433]:
- link "Widespread HIPAA vulnerabilities result in $2.7 million settlement with Oregon Health & Science University" [ref=e434] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/ohsu/index.html
- text: "- July 18, 2016"
- listitem [ref=e435]:
- link "Business Associate’s Failure to Safeguard Nursing Home Residents’ PHI Leads to $650,000 HIPAA Settlement" [ref=e436] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/catholic-health-care-services/index.html
- text: "- June 29, 2016"
- listitem [ref=e437]:
- link "Unauthorized Filming for “NY Med” Results in $2.2 Million Settlement with New York Presbyterian Hospital" [ref=e438] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/new-york-presbyterian-hospital/index.html
- text: "- April 21, 2016"
- listitem [ref=e439]:
- link "$750,000 settlement highlights the need for HIPAA business associate agreements" [ref=e440] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/raleigh-orthopaedic-clinic/index.html
- listitem [ref=e441]:
- link "Improper disclosure of research participants’ protected health information results in $3.9 million HIPAA settlement" [ref=e442] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/feinstein/index.html
- text: "- March 17, 2016"
- listitem [ref=e443]:
- link "$1.55 million settlement underscores the importance of executing HIPAA business associate agreements" [ref=e444] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/north-memorial-health-care/index.html
- text: "- March 16, 2016"
- listitem [ref=e445]:
- link "Physical therapy provider settles violations that it impermissibly disclosed patient information" [ref=e446] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/complete-pt/index.html
- text: "- February 16, 2016"
- listitem [ref=e447]:
- link "Administrative Law Judge rules in favor of OCR enforcement, requiring Lincare, Inc. to pay $239,800" [ref=e448] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/lincare/index.html
- text: "- February 3, 2016"
- listitem [ref=e449]:
- link "$750,000 HIPAA Settlement Underscores the Need for Organization Wide Risk Analysis" [ref=e450] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/university-of-washington-medicine/index.html
- text: "- December 14, 2015"
- listitem [ref=e451]:
- link "Triple-S Management Corporation Settles HHS Charges by Agreeing to $3.5 Million HIPAA Settlement" [ref=e452] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/triple-s-management/index.html
- text: "- November 30, 2015"
- listitem [ref=e453]:
- link "HIPAA Settlement Reinforces Lessons for Users of Medical Devices" [ref=e454] [cursor=pointer]:
- /url: /hipaa/for-professionals/compliance-enforcement/agreements/lahey.html
- text: "- November 24, 2015"
- listitem [ref=e455]:
- link "750,000 HIPAA Settlement Emphasizes the Importance of Risk Analysis and Device and Media Control Policies" [ref=e456] [cursor=pointer]:
- /url: /ocr/privacy/hipaa/enforcement/examples/cancercare.html
- text: "- August 31, 2015"
- listitem [ref=e457]:
- link "HIPAA Settlement Highlights Importance of Safeguards When Using Internet Applications" [ref=e458] [cursor=pointer]:
- /url: /ocr/privacy/hipaa/enforcement/examples/SEMC/semc.html
- text: "- June 10, 2015"
- listitem [ref=e459]:
- link "HIPAA Settlement Highlights the Continuing Importance of Secure Disposal of Paper Medical Records" [ref=e460] [cursor=pointer]:
- /url: /ocr/privacy/hipaa/enforcement/examples/cornell/index.html
- text: "- April 22, 2015"
- listitem [ref=e461]:
- link "HIPAA Settlement Underscores the Vulnerability of Unpatched and Unsupported Software" [ref=e462] [cursor=pointer]:
- /url: /ocr/privacy/hipaa/enforcement/examples/acmhs/index.html
- text: "- December 2, 2014"
- listitem [ref=e463]:
- link "$800,000 HIPAA Settlement in Medical Records Dumping Case" [ref=e464] [cursor=pointer]:
- /url: /ocr/privacy/hipaa/enforcement/examples/parkview.html
- text: "- June 23, 2014"
- listitem [ref=e465]:
- link "Data Breach Results in $4.8 Million HIPAA Settlements" [ref=e466] [cursor=pointer]:
- /url: /ocr/privacy/hipaa/enforcement/examples/jointbreach-agreement.html
- text: "- May 7, 2014"
- listitem [ref=e467]:
- link "Concentra Settles HIPAA Case for $1,725,220" [ref=e468] [cursor=pointer]:
- /url: /ocr/privacy/hipaa/enforcement/examples/stolenlaptops-agreements.html
- text: "- April 22, 2014"
- listitem [ref=e469]:
- link "QCA Settles HIPAA Case for $250,000" [ref=e470] [cursor=pointer]:
- /url: /ocr/privacy/hipaa/enforcement/examples/stolenlaptops-agreements.html
- text: "- April 22, 2014"
- listitem [ref=e471]:
- link "County Government Settles Potential HIPAA Violations" [ref=e472] [cursor=pointer]:
- /url: /ocr/privacy/hipaa/enforcement/examples/skagit-agreement.html
- text: "- March 7, 2014"
- listitem [ref=e473]:
- link "Resolution Agreement with Adult & Pediatric Dermatology, P.C. of Massachusetts" [ref=e474] [cursor=pointer]:
- /url: /ocr/privacy/hipaa/enforcement/examples/apderm-agreement.html
- text: "- December 20, 2013"
- listitem [ref=e475]:
- link "HHS Settles with Health Plan in Photocopier Breach Case" [ref=e476] [cursor=pointer]:
- /url: /ocr/privacy/hipaa/enforcement/examples/affinity-agreement.html
- text: "- August 14, 2013"
- listitem [ref=e477]:
- link "WellPoint Settles HIPAA Security Case for $1,700,000" [ref=e478] [cursor=pointer]:
- /url: /ocr/privacy/hipaa/enforcement/examples/wellpoint-agreement.html
- text: "- July 11, 2013"
- listitem [ref=e479]:
- link "Shasta Regional Medical Center Settles HIPAA Privacy Case for $275,000" [ref=e480] [cursor=pointer]:
- /url: /ocr/privacy/hipaa/enforcement/examples/shasta-agreement.html
- text: "- June 13, 2013"
- listitem [ref=e481]:
- link "Idaho State University Settles HIPAA Security Case for $400,000" [ref=e482] [cursor=pointer]:
- /url: /ocr/privacy/hipaa/enforcement/examples/isu-agreement.html
- text: "- May 21, 2013"
- listitem [ref=e483]:
- link "HHS announces first HIPAA breach settlement involving less than 500 patients" [ref=e484] [cursor=pointer]:
- /url: /ocr/privacy/hipaa/enforcement/examples/honi-agreement.html
- text: "- December 31, 2012"
- listitem [ref=e485]:
- link "Massachusetts Provider Settles HIPAA Case for $1.5 Million" [ref=e486] [cursor=pointer]:
- /url: /ocr/privacy/hipaa/enforcement/examples/meei-agreement.html
- text: "- September 17, 2012"
- listitem [ref=e487]:
- link "Alaska DHSS Settles HIPAA Security Case for $1,700,000" [ref=e488] [cursor=pointer]:
- /url: /ocr/privacy/hipaa/enforcement/examples/alaska-agreement.html
- text: "- June 26, 2012"
- listitem [ref=e489]:
- link "HHS Settles Case with Phoenix Cardiac Surgery for Lack of HIPAA Safeguards" [ref=e490] [cursor=pointer]:
- /url: /ocr/privacy/hipaa/enforcement/examples/pcsurgery_agreement.html
- text: "- April 13, 2012"
- listitem [ref=e491]:
- link "HHS settles HIPAA case with BCBST for $1.5 million" [ref=e492] [cursor=pointer]:
- /url: /ocr/privacy/hipaa/enforcement/examples/bcbstagrmnt.html
- text: "- March 13, 2012"
- listitem [ref=e493]:
- link "Resolution Agreement with the University of California at Los Angeles Health System" [ref=e494] [cursor=pointer]:
- /url: /ocr/privacy/hipaa/enforcement/examples/uclaagreement.html
- text: "- July 6, 2011"
- listitem [ref=e495]:
- link "Resolution Agreement with General Hospital Corp. & Massachusetts General Physicians Organization, Inc." [ref=e496] [cursor=pointer]:
- /url: /ocr/privacy/hipaa/enforcement/examples/massgeneralra.html
- text: "- February 14, 2011"
- listitem [ref=e497]:
- link "Civil Money Penalty issued to Cignet Health of Prince George's County, MD" [ref=e498] [cursor=pointer]:
- /url: /ocr/privacy/hipaa/enforcement/examples/cignetcmp.html
- text: "- February 4, 2011"
- listitem [ref=e499]:
- link "Resolution Agreement with Management Services Organization Washington, Inc." [ref=e500] [cursor=pointer]:
- /url: /ocr/privacy/hipaa/enforcement/examples/msoresagr.html
- text: "- December 13, 2010"
- listitem [ref=e501]:
- link "Resolution Agreement with Rite Aid Corporation" [ref=e502] [cursor=pointer]:
- /url: /ocr/privacy/hipaa/enforcement/examples/riteaidresagr.html
- text: "- July 27, 2010"
- listitem [ref=e503]:
- link "Resolution Agreement with CVS Pharmacy, Inc." [ref=e504] [cursor=pointer]:
- /url: /ocr/privacy/hipaa/enforcement/examples/cvsresolutionagreement.html
- text: "- January 16, 2009"
- listitem [ref=e505]:
- link "Resolution Agreement with Providence Health & Services" [ref=e506] [cursor=pointer]:
- /url: /ocr/privacy/hipaa/enforcement/examples/providenceresolutionagreement.html
- text: "- July 16, 2008"
- generic [ref=e516]:
- text: Content last reviewed
- time [ref=e517]: March 5, 2026
- contentinfo [ref=e518]:
- link [ref=e519] [cursor=pointer]:
- /url: "#top"
- img [ref=e520]
- generic [ref=e522]: Back to top
- generic "Social media links and sign up" [ref=e523]:
- generic [ref=e525]:
- generic [ref=e526]:
- img "Secretary Robert F. Kennedy Jr." [ref=e528]
- generic [ref=e529]:
- heading "Follow @SecKennedy" [level=2] [ref=e530]
- generic [ref=e531]:
- link "Visit the Facebook account of Secretary Kennedy" [ref=e533] [cursor=pointer]:
- /url: https://www.facebook.com/SecKennedy
- img [ref=e534]
- link "Visit the X account of Secretary Kennedy" [ref=e537] [cursor=pointer]:
- /url: https://x.com/SecKennedy
- img [ref=e538]
- link "Visit the Instagram account of Secretary Kennedy" [ref=e541] [cursor=pointer]:
- /url: https://www.instagram.com/seckennedy/
- img [ref=e542]
- link "Visit the Truth Social account of Secretary Kennedy" [ref=e545] [cursor=pointer]:
- /url: https://truthsocial.com/@seckennedy
- img [ref=e546]
- link "Visit the LinkedIn account of Secretary Kennedy" [ref=e549] [cursor=pointer]:
- /url: https://www.linkedin.com/showcase/secretarykennedy/
- img [ref=e550]
- generic [ref=e552]:
- img "HHS icon" [ref=e554]
- generic [ref=e555]:
- heading "Follow @HHSGov" [level=2] [ref=e556]
- generic [ref=e557]:
- link "Visit the HHS Facebook account" [ref=e559] [cursor=pointer]:
- /url: https://www.facebook.com/HHS
- img [ref=e560]
- link "Visit the HHS X account" [ref=e563] [cursor=pointer]:
- /url: https://x.com/hhsgov
- img [ref=e564]
- link "Visit the HHS YouTube account" [ref=e567] [cursor=pointer]:
- /url: https://www.youtube.com/user/USGOVHHS?sub_confirmation=1
- img [ref=e568]
- link "Visit the HHS Instagram account" [ref=e571] [cursor=pointer]:
- /url: https://www.instagram.com/hhsgov/
- img [ref=e572]
- link "Visit the HHS LinkedIn account" [ref=e575] [cursor=pointer]:
- /url: https://www.linkedin.com/company/hhsgov
- img [ref=e576]
- generic [ref=e586]:
- heading "HHS Email updates" [level=3] [ref=e587]
- paragraph [ref=e588]: Receive email updates from HHS.
- paragraph [ref=e589]:
- link "Subscribe" [ref=e590] [cursor=pointer]:
- /url: https://cloud.connect.hhs.gov/subscriptioncenter
- contentinfo "Agency logo and contact information" [ref=e591]:
- generic [ref=e592]:
- link "HHS Logo" [ref=e596] [cursor=pointer]:
- /url: https://hhs.gov
- img "HHS Logo" [ref=e597]
- generic [ref=e598]:
- generic [ref=e600]:
- heading "HHS Headquarters" [level=3] [ref=e601]
- paragraph [ref=e605]:
- text: 200 Independence Avenue, S.W.
- text: Washington, D.C. 20201
- text: "Toll Free Call Center: 1-877-696-6775"
- navigation [ref=e607]:
- generic [ref=e608]:
- list [ref=e610]:
- listitem [ref=e611]:
- link "Contact HHS" [ref=e612] [cursor=pointer]:
- /url: /about/contact-us/index.html
- listitem [ref=e613]:
- link "Careers" [ref=e614] [cursor=pointer]:
- /url: https://www.hhs.gov/careers/
- listitem [ref=e615]:
- link "HHS FAQs" [ref=e616] [cursor=pointer]:
- /url: /answers/index.html
- listitem [ref=e617]:
- link "Nondiscrimination Notice" [ref=e618] [cursor=pointer]:
- /url: /civil-rights/for-individuals/nondiscrimination/index.html
- list [ref=e620]:
- listitem [ref=e621]:
- link "Press Room" [ref=e622] [cursor=pointer]:
- /url: /press-room/index.html
- listitem [ref=e623]:
- link "HHS Archive" [ref=e624] [cursor=pointer]:
- /url: /about/archive/index.html
- listitem [ref=e625]:
- link "Accessibility Statement" [ref=e626] [cursor=pointer]:
- /url: /web/section-508/hhs-digital-accessibility-statement/index.html
- list [ref=e628]:
- listitem [ref=e629]:
- link "Budget/Performance" [ref=e630] [cursor=pointer]:
- /url: /about/budget/index.html
- listitem [ref=e631]:
- link "Inspector General" [ref=e632] [cursor=pointer]:
- /url: https://oig.hhs.gov/
- listitem [ref=e633]:
- link "Web Site Disclaimers" [ref=e634] [cursor=pointer]:
- /url: /web/policies-and-standards/hhs-web-policies/disclaimer/index.html
- listitem [ref=e635]:
- link "EEO/No Fear Act" [ref=e636] [cursor=pointer]:
- /url: /about/agencies/asa/eeo/no-fear-act/index.html
- list [ref=e638]:
- listitem [ref=e639]:
- link "FOIA" [ref=e640] [cursor=pointer]:
- /url: /foia/index.html
- listitem [ref=e641]:
- link "The White House" [ref=e642] [cursor=pointer]:
- /url: https://www.whitehouse.gov/
- listitem [ref=e643]:
- link "USA.gov" [ref=e644] [cursor=pointer]:
- /url: https://www.usa.gov/
- listitem [ref=e645]:
- link "Vulnerability Disclosure Policy" [ref=e646] [cursor=pointer]:
- /url: /vulnerability-disclosure-policy/index.html
```