HHS OCR Fines Firm $10K in Breach Affecting 15M

U.S. federal regulators fined a dental practice software vendor with a seemingly lowball financial penalty for a high-stakes 2020 hack affecting 15 million individuals that the company failed to report.

See Also: Using the Netskope HIPAA Mapping Guide

The Department of Health and Human Services on Thursday said Maryland-based MMG Fusion has agreed to pay a $10,000 financial settlement and will implement a corrective action plan that regulators will monitor for three years.

The low dollar amount of the settlement – compared with much higher HIPAA fines paid in smaller protected health information breach cases – was due to the agency taking into consideration the “financial condition” of the company, said the Office of Civil Rights, the HHS agency that enforces health privacy regulations.

“The MMG settlement is small because MMG is essentially out of business,” said regulatory attorney Paul Hales of the Hales Law Group, who is not involved in the case. The settlement agreement was signed by HiQOR Dental, as successor-in-interest to MMG.

HIPAA regulations require the government to consider a number of factors when determining a penalty. “Among those factors is the financial condition of the organization and their ability to pay,” said regulatory attorney David Holtzman, retired founder of consulting firm HITprivacy and a former HHS OCR senior adviser.

HHS OCR said it initiated an investigation into MMG in March 2023 after it received a complaint about an unreported security incident and the posting of protected health information on the darkweb.

Investigators found that a threat actor infiltrated MMG’s IT systems and accessed protected health information in December 2020, including names, phone numbers, mailing addresses, email addresses, dates of birth, and dates and times of medical appointments.

OCR determined that MMG potentially violated several HIPAA provisions. That included impermissibly disclosing the PHI of about 15 million individuals, failing to notify covered entities affected by the incident of the breach and failing beforehand to conduct an accurate and thorough risk analysis to determine the potential risks and vulnerabilities.

Despite the small amount of the MMG settlement in comparison to the size of the breach, Hales said HHS OCR likely chose to make MMG’s HIPAA investigation “an object lesson” for the agency’s ongoing HIPAA risk analysis enforcement initiative launched in October 2024, Hales said. “The corrective action plan outlines, step-by-step, OCR’s expectations for risk analysis and security rule compliance,” he said.

Under the corrective action plan, which HHS OCR will monitor for the next three years, MMG agreed to take several measures, including conducting a comprehensive HIPAA security risk analysis, implementing an enterprise-wide risk management plan, and maintaining written HIPAA security and privacy rule policies.

In addition, MMG must conduct a breach risk assessment of the December 2020 cyberattack “and, to the extent possible, provide affected covered entities with an accurate notice of the beach incident.” HHS OCR said.