What happened
Troutman Pepper Locke, in an article dated August 4, 2026, reported that OCR announced two settlements with self-funded group health plans following ransomware breaches. The firm reported the total as $695,000.
The firm reported that the first settlement was announced in April 2026 with a plan sponsored by an energy provider. The plan paid $245,000 and agreed to a two year monitored corrective action plan, and OCR found it failed to conduct an accurate and thorough risk analysis of ePHI on the plan sponsor’s systems. The firm reported that the second was announced in June 2026 with a plan sponsored by a national retailer. That plan paid $450,000 and agreed to a two year monitored corrective action plan, and OCR found it failed to conduct an accurate and thorough risk analysis and failed to implement reasonable and appropriate HIPAA policies and procedures.
What we have not verified
We have not read the HHS press releases for these two actions. The article links to them, but we could not open them in this session. The date used for this brief is the date of the article, not the dates of the OCR announcements, which the article gives only by month. We are watching for the official pages and will treat the details above as reported until we have read them.
Analysis: Most ABA clinics buy insured group coverage for their staff, so the plan structure at issue here may not apply to a given clinic. What carries over is the finding. Both settlements cite the risk analysis, and the second adds policies and procedures. A clinic that sponsors its own health plan, or that shares systems with an affiliated entity that does, should confirm that the analysis covers the systems the plan’s data actually sits on. Everyone else can read this as one more data point that OCR keeps returning to the same document. This is reporting, not legal advice.
About the settlement figure: it is the amount paid to OCR. It does not include the entity's own costs of responding, such as staff time, outside advisers and remediation, or any private claims.
Compliance you can actually show.
WiseUpHIPAA is built for ABA clinics. It works out what applies to you, holds your decisions and the evidence behind them, and shows you honestly where you stand, including the parts that are not done yet.