OCR's enforcement counts and the settlements behind them, each linked to the official page it came from.
A settlement figure is what was paid to OCR. It does not include the entity's own cost of getting there: staff time, outside advisers and fixes.
Time
Years, not weeks. Ambry's breach began with a phishing attack in January 2020, and OCR announced the settlement in September 2026. HHS release Azul Vision's records request was made in January 2023 and the settlement came in August 2026. HHS release
Monitoring
Seven of the ten settlements carry a two year corrective action plan that OCR monitors, and two carry a three year plan. One release does not state the length.
LawsuitsReported
Private lawsuits are a separate cost. HIPAA Journal reported a $65 million class action settlement over the Lehigh Valley ransomware attack. Medcurity reported a $12.25 million class action settlement over the Ambry breach.
Not every settlement is accompanied by a lawsuit, and we have not read the court filings. This is reporting, not legal advice.
No pressure, no pitch. Book a 20-minute call, or just email a question and we'll point you the right way.