https://www.wiseuphipaa.com/desk/The HIPAA DeskRecent HIPAA developments for ABA clinics, from WiseUpHIPAA.2026-10-29T00:00:00ZWiseUpHIPAAhttps://www.wiseuphipaa.com/desk/lehigh-valley-800000-ransomware/OCR settles with Pennsylvania health system Lehigh Valley Health Network for $800,000 after ransomware2026-10-29T00:00:00Z2026-10-29T00:00:00ZAfter a ransomware attack affecting 248,359 people, OCR cited four issues and the health system paid $800,000. Primary source: HHS Office for Civil Rights.https://www.wiseuphipaa.com/desk/shen-smiles-140000-right-of-access/OCR settles with a Pennsylvania dental practice for $140,000 over a patient's records request2026-10-08T00:00:00Z2026-10-08T00:00:00ZOCR found the practice failed to give a patient timely access to her records and did not reasonably safeguard PHI. Primary source: HHS Office for Civil Rights.https://www.wiseuphipaa.com/desk/part-2-medicaid-guidance-september-2026/OCR issues guidance on when Part 2 substance use records can help state Medicaid programs verify exclusions2026-09-29T00:00:00Z2026-09-29T00:00:00ZOCR clarified when Part 2 lets a state Medicaid agency use substance use disorder records to verify an exclusion. Primary source: HHS Office for Civil Rights.https://www.wiseuphipaa.com/desk/ambry-genetics-700000-risk-analysis/OCR settles with genetic testing company Ambry Genetics for $700,000 after a phishing attack2026-09-17T00:00:00Z2026-09-17T00:00:00ZAfter a phishing attack reached 225,370 people's PHI, OCR cited three Security Rule issues and Ambry paid $700,000. Primary source: HHS Office for Civil Rights.https://www.wiseuphipaa.com/desk/breach-report-august-2026/Paubox reported 34 large healthcare breaches affecting 7.7 million people in August 20262026-09-15T00:00:00Z2026-09-15T00:00:00ZPaubox reported 34 large breaches affecting 7,690,666 people in August 2026, most through network servers. Reported by Paubox.https://www.wiseuphipaa.com/desk/azul-vision-50000-right-of-access/OCR settles with California eye care provider Azul Vision for $50,000 over a delayed records request2026-08-27T00:00:00Z2026-08-27T00:00:00ZA records request made in January 2023 was not filled until January 2025, after OCR opened its investigation. Primary source: HHS Office for Civil Rights.https://www.wiseuphipaa.com/desk/self-funded-health-plans-695000-ransomware/Troutman Pepper Locke reported OCR settlements totaling $695,000 with two self-funded health plans after ransomware2026-08-04T00:00:00Z2026-08-04T00:00:00ZTroutman Pepper Locke reported two OCR settlements with self-funded group health plans after ransomware, $245,000 and $450,000. Reported by Troutman Pepper Locke.https://www.wiseuphipaa.com/desk/security-rule-final-rule-delayed-july-2027/Alston & Bird reported HHS has pushed the HIPAA Security Rule final rule to July 20272026-07-10T00:00:00Z2026-07-10T00:00:00ZAlston & Bird reported HHS OCR has delayed finalizing the HIPAA Security Rule until July 2027. Reported by Alston & Bird.https://www.wiseuphipaa.com/desk/right-of-access-nprm-november-2026/Davis Wright Tremaine reported HHS lists a right of access timing proposed rule for November 20262026-07-08T00:00:00Z2026-07-08T00:00:00ZDavis Wright Tremaine reported HHS's agenda lists a proposed rule on records request response time for November 2026. Reported by Davis Wright Tremaine.https://www.wiseuphipaa.com/desk/healthcare-breaches-first-half-2026/Paubox reported more than 19 million people affected by healthcare data breaches in the first half of 20262026-06-30T00:00:00Z2026-06-30T00:00:00ZPaubox reported more than 19 million people affected by 189 large healthcare breaches in the first half of 2026. Reported by Paubox.https://www.wiseuphipaa.com/desk/risk-analysis-initiative-13-actions/OCR says 13 investigations are complete under its Risk Analysis Initiative2026-04-23T00:00:00Z2026-04-23T00:00:00ZOCR's release counts 13 completed Risk Analysis Initiative investigations, with four settlements announced the same day. Primary source: HHS Office for Civil Rights.https://www.wiseuphipaa.com/desk/balance-autism-class-action-1281/HIPAA Journal reported an Iowa autism provider settled a class action over a breach affecting 1,281 people2026-03-23T00:00:00Z2026-03-23T00:00:00ZHIPAA Journal reported an autism provider settled a class action after a breach affecting 1,281 people. Reported by HIPAA Journal.https://www.wiseuphipaa.com/desk/top-of-the-world-ranch-103000-risk-analysis/OCR settles with an Illinois treatment center for $103,000 after a phishing attack exposed 1,980 patients2026-02-19T00:00:00Z2026-02-19T00:00:00ZAfter a phishing attack hit 1,980 patients' ePHI, OCR found the provider failed to conduct a thorough risk analysis. Primary source: HHS Office for Civil Rights.