Health System Pays Feds $600K to Settle HIPAA Breach Case

A regional healthcare network with three California hospitals serving Los Angeles and Orange Counties has agreed to pay federal regulators $600,000 and implement a corrective action plan to resolve potential HIPAA violations identified during an investigation into a 2019 breach triggered by a phishing attack.

See Also: Top 10 Technical Predictions for 2025

The U.S. Department of Health and Human Services on Wednesday said the resolution agreement with Whittier, Calif.-based PIH Health comes in the wake of the federal agency’s investigation into a breach report PIH Health filed in January 2020 – seven months after a June 2019 phishing attack compromised 45 employee email accounts (see: Health Data Breach Not Reported for Seven Months) .

Under HIPAA, protected health information breaches affecting 500 or more individuals must be reported to HHS OCR within 60 days of discovery. Affected individuals and the media also must be notified of HIPAA breaches within 60 days of discovery.

The PIH Health phishing incident affected the electronic PHI of nearly 190,000 people, including names, addresses, date of birth, Social Security numbers, driver’s license numbers, diagnoses, lab results, medications, treatment and claims information and financial information.

“Hacking is one of the most common types of large breaches reported to OCR every year,” said Anthony Archeval, acting director of HHS OCR in a statement. “HIPAA-regulated entities need to be proactive and remedy the deficiencies in their HIPAA compliance programs before those deficiencies result in the impermissible disclosure of patients’ protected health information.”

Besides PIH Health’s delayed breach notification, HHS OCR’s investigation found other potential HIPAA rule violations, including failure to use or disclose PHI only as permitted or required under the HIPAA Privacy Rule and failure to conduct an accurate and thorough HIPAA security risk analysis.

In addition to paying the six-figure financial settlement, PIH has agreed to implement a corrective action plan that HHS OCR will monitor for two years.

Under the corrective action plan, PIH must:

• Conduct an accurate and thorough risk analysis of the potential risks and vulnerabilities to the confidentiality, integrity and availability of its ePHI;
• Develop and implement a risk management plan to address and mitigate security risks and vulnerabilities identified in its risk analysis;
• Develop, maintain and revise, as needed, its written policies and procedures to comply with the HIPAA Rules;
• Train its workforce members who have access to PHI on its HIPAA policies and procedures.

PIH Health did not immediately respond to Information Security Media Group’s request for comment on the organization’s settlement with HHS OCR.

The settlement with PIH Health is HHS OCR’s 12th HIPAA enforcement so far in 2025.

The resolution agreement with PIH Health, signed on Jan. 28, appears to be the second HIPAA enforcement action taken by the Trump administration. The 10 other HIPAA enforcement actions so far this year were finalized by HHS OCR during the final months of the Biden administration (see: Guam Hospital Pays Feds $25K to Settle HIPAA Investigation).