Settlements, rule changes, and breach figures as they land, each in a short brief that names its source and says what it means for an ABA clinic. Primary means we read the official source. Reported means we are relaying a named outlet and say what we have not verified.
What OCR has resolved, with the amount and what it found.
After a ransomware attack affecting 248,359 people, OCR cited four issues and the health system paid $800,000.
HHS Office for Civil Rights
OCR found the practice failed to give a patient timely access to her records and did not reasonably safeguard PHI.
HHS Office for Civil Rights
After a phishing attack reached 225,370 people's PHI, OCR cited three Security Rule issues and Ambry paid $700,000.
HHS Office for Civil Rights
A records request made in January 2023 was not filled until January 2025, after OCR opened its investigation.
HHS Office for Civil Rights
Troutman Pepper Locke reported two OCR settlements with self-funded group health plans after ransomware, $245,000 and $450,000.
Troutman Pepper Locke
After a phishing attack hit 1,980 patients' ePHI, OCR found the provider failed to conduct a thorough risk analysis.
HHS Office for Civil Rights
Where OCR is aiming its attention, and how the counts are moving.
OCR's release counts 13 completed Risk Analysis Initiative investigations, with four settlements announced the same day.
HHS Office for Civil Rights
Proposed and final rules, dates and delays.
Alston & Bird reported HHS OCR has delayed finalizing the HIPAA Security Rule until July 2027.
Alston & Bird
Davis Wright Tremaine reported HHS's agenda lists a proposed rule on records request response time for November 2026.
Davis Wright Tremaine
What HHS has clarified, and who it applies to.
OCR clarified when Part 2 lets a state Medicaid agency use substance use disorder records to verify an exclusion.
HHS Office for Civil Rights
The numbers on breaches, and what happened at providers like yours.
Paubox reported 34 large breaches affecting 7,690,666 people in August 2026, most through network servers.
Paubox
Paubox reported more than 19 million people affected by 189 large healthcare breaches in the first half of 2026.
Paubox
HIPAA Journal reported an autism provider settled a class action after a breach affecting 1,281 people.
HIPAA Journal
No pressure, no pitch. Book a 20-minute call, or just email a question and we'll point you the right way.