HHS Discloses 3 More HIPAA Fines Totaling More Than $3M

A medical supply firm has agreed to pay $3 million and implement a corrective action plan to settle potential HIPAA violations federal regulators identified during an investigation into a 2019 phishing breach that affected about 114,000 people. It was one of three U.S. Department of Health and Human Services fines this week – the latest in a spate of HIPAA enforcement actions as the Biden administration wraps up.

See Also: Using the Netskope HIPAA Mapping Guide

In addition to that settlement with Solara Medical Suppliers LLC announced Tuesday, HHS on Wednesday also disclosed a $10,000 settlement with Northeast Surgical Group, a surgical services practice in Michigan for a 2023 ransomware breach affecting nearly 15,300 individuals.

Besides those breach related enforcement action, HHS OCR also disclosed on Wednesday a $60,000 settlement with South Broward Hospital District in Florida – which does business as Memorial Healthcare System – to resolve a patient right-of-access dispute. It was the agency’s 52nd such enforcement action since launching its right-of-access initiative in 2019.

The financial payment to HHS OCR is also Solara’s second multimillion dollar settlement involving the phishing breach. Solara – one of several dozen home-health and medical equipment firms owned by parent AdaptHealth – in 2022 agreed to pay $5 million and implement improvements to its data security practices to settle a proposed federal civil class action lawsuit centered on the phishing breach (see: $5M Settlement Calls for Vendor to Improve Security).

On a Roll

HHS OCR’s $3 million resolution agreement with Solara, Memorial Healthcare System, and Northeast Surgical are the federal agency’s fourth, fifth and sixth HIPAA enforcement actions disclosed since the New Year kicked off, totaling about $3.58 million in fines.

The other cases involved a $337,750 settlement last week with USR Holdings, a Florida-based behavioral health holding company, for a 2018 incident involving the deletion of electronic protected health information pertaining to nearly 3,000 patients (see: Florida Firm Fined $337K By Feds for Data Deleted in Hack).

HHS OCR also announced settlements last week involving investigations into separate ransomware breaches reported by Elgon, a Massachusetts firm that provides billing and other services to home health agencies, and Virtual Private Network Solutions, a Virginia-based data hosting and cloud provider. Elgon and VPN Solution respectively paid HHS OCR $80,000 and $90,000 in addition to agreeing to implement corrective action plans (see: 2 HIPAA Business Associates Pay Ransomware Settlements).

The settlement with Solara is the fourth HHS OCR enforcement action against a business associate in recent weeks, signaling the continued scrutiny of vendors that support healthcare delivery organizations into the coming year, said Lisa Gallagher, national cybersecurity advisor at the College of Healthcare Information Management Executives, a professional association of healthcare CISOs and CIOs.

“After the massive supply-chain disruptions seen in 2024, it is clear that HIPAA business associates must meet basic security requirements standard in other sectors, like risk assessments,” she said. “Even when resources are constrained, a risk assessment can reveal gaps in policies and procedures to begin planning for prioritized remediation – even if it’s a future task.”

Solara Case Details

Regarding its settlement with Solara, HHS OCR said that in November 2019 the agency received a breach report concerning a phishing attack in which an unauthorized third party gained access to eight of Solara’s employees’ email accounts between April and June 2019, resulting in a compromise of 114,007 individuals’ electronic protected health information.

Then in January 2020, OCR received notification of a second breach, when Solara reported that it had sent 1,531 notification letters for the phishing breach to the wrong mailing addresses.

OCR said its investigation determined that Solara failed to conduct a compliant risk analysis to identify the potential risks and vulnerabilities to ePHI in Solara’s systems; failed to implement security measures sufficient to reduce the risks and vulnerabilities to ePHI to a reasonable and appropriate level; and failed to provide timely breach notification to individuals, HHS, and the media.

“Cyberattacks have skyrocketed exponentially in recent years. Effective cybersecurity requires identifying potential risks and vulnerabilities to health information and implementing effective security measures to protect against them,” said Melanie Fontes Rainer, HHS OCR director.

“Healthcare entities that fail to address identified cybersecurity issues leave themselves vulnerable to cyberattacks. OCR urges healthcare entities to prioritize securing their information systems and take all necessary steps to reduce and prevent cyberattacks and safeguard protected health information.”

Besides the financial penalty, Solara has agreed to implement a corrective action plan to improve its compliance with the HIPAA privacy, security and breach notification rules, including conducting a comprehensive HIPAA security risk analysis.

Solara did not immediately respond to Information Security Media Group’s request for comment in the settlement.

Memorial Healthcare Dispute

In the HIPAA settlement with Memorial Healthcare, HHS OCR said it initiated an investigation after a receiving complaint from a patient who said the practice did not give him timely access to his medical records, despite multiple requests by mail, telephone and Memorial Healthcare System’s patient portal, beginning on Dec. 30, 2020.

The patient did not receive access to his requested records until about nine months later, after OCR initiated its investigation. OCR found that Memorial Healthcare System failed to take timely action to respond to the patient’s right-of-access requests in compliance with the HIPAA privacy rule.

OCR issued a Notice of Proposed Determination in July 2024 for imposing a civil monetary penalty against Memorial Healthcare System, and the organization subsequently requested a hearing before an administrative law judge. On Dec. 13, 2024, Memorial Healthcare System agreed to a settlement, including payment of $60,000, to resolve pending administrative litigation.

Northeast Surgical Breach

HHS OCR’s action against Northeast Surgical is the agency’s 10th involving a ransomware breach since launching its ransomware enforcement initiative in late 2024.

HHS OCR said that in March 2023, the agency received a breach report concerning a ransomware incident affecting Northeast Surgical’s information system. The healthcare provider determined that the PHI of 15,298 patients had been encrypted and exfiltrated from its network.

OCR’s investigation found that Northeast Surgical failed to conduct a compliant risk analysis to determine the potential risks and vulnerabilities to ePHI in its systems.

Besides the financial settlement, Northeast Surgical has agreed to implement a corrective action plan that includes conducting a comprehensive risk analysis.

Enforcement Trends

During Fontes Rainer’ tenure leading HHS OCR, the agency has achieved “a notable level of success” in efforts to enforce the HIPAA privacy and security regulations, said regulatory attorney David Holtzman of consulting firm HITPrivacy LLC.

“Settlements and civil money penalties since 2022 have paid well over $10 million into the lockbox account created by the HITECH Act as a set aside for HIPAA enforcement and education,” Holtzman said.

“The hundreds of millions of dollars in fines and penalties collected over the past 15 years that may be sitting in the HIPAA lockbox could prove to be an albatross around the neck of efforts by a new administration to weaken or do away with HIPAA’s enforcement scheme,” he said. “Only time will tell.”

Despite HHS OCR efforts to ramp up HIPAA enforcement – especially during these last weeks and months of Biden administration – the agency has contended that it lacks the resources to address its long list of regulatory to-do items, while the volume of major HIPAA breaches and complaints continues to soar.

HHS OCR last year said it was planning to resume its HIPAA compliance audits, which have been dormant since 2020, but the program is still on the back burner as the agency deals with resource constraints.

An HHS Office of Inspector General report issued in November also recommended that HHS OCR revive the compliance audit program to help improve the protection of patient data by regulated entities.

“OCR has had nearly flat appropriations for 20 years, even with OCR’s continued requests for additional appropriations and resources, which has resulted in unsustainable workloads,” the agency told ISMG in response to the HHS OIG report (see: Watchdog Report: HHS OCR Should Beef Up HIPAA Audit Program).

Other experts note that many of HHS OCR’s enforcement actions take years to play out. For instance, the settlement with Solara involved a phishing breach that was reported in 2019.

“OCR backlogs drive these delays, creating financial uncertainty,” said Russell Teague, CISO of consulting firm Fortified Health. “In 2024, 60% of reported incidents remain under open investigation, meaning organizations face years of waiting before fines and corrective action plans are determined,” he said.

The larger issue is that these backlogs prevent OCR from fully understanding the implications of these attacks on healthcare, Teague said.

“Are breaches primarily due to gross negligence, or do they result from financial constraints? If the majority stem from negligence, it points to a lack of executive prioritization. If only a small percentage fall into this category, it suggests a broader systemic issue – healthcare’s inability to afford necessary cybersecurity measures,” he said.

“Without timely data, we can’t accurately assess the problem or determine the appropriate path forward.”