Loading story…
The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) launched a new enforcement program and web portal for reporting breaches involving 42 CFR Part 2 substance use disorder (SUD) patient records, and updated its HIPAA breach website to direct covered entities to the new reporting mechanism. The initiative is intended to support newly effective mandates aimed at strengthening confidentiality protections for SUD records.
HHS OCR described the program as a “landmark” civil enforcement mechanism for Part 2 confidentiality requirements, enabling OCR to pursue civil monetary penalties and negotiate resolution agreements, settlements, and corrective actions for noncompliance. Reported penalties and enforcement options are positioned to align with OCR’s existing HIPAA breach enforcement approach, signaling increased regulatory scrutiny for organizations handling SUD treatment records.
See the reporting duties and controls this puts on the clock.
2 events from the most recent confirmed update back to the earliest known activity.
The new federal mandates for reporting and enforcing breaches involving 42 CFR Part 2 substance use disorder records took effect, requiring reports within 60 days of discovery for breaches affecting 500 or more individuals and annual reporting for smaller incidents. HHS also updated its HIPAA breach reporting website to reflect OCR's authority to investigate and enforce both HIPAA and Part 2 breaches.
The U.S. Department of Health and Human Services, through its Office for Civil Rights, launched a new web portal and civil enforcement program for breaches involving substance use disorder records protected under 42 CFR Part 2. The program enables reporting and public viewing of breaches affecting 500 or more individuals and gives OCR enforcement options similar to HIPAA, including penalties, settlements, and corrective actions.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Reporting on healthcare security trends indicates **breach incidents increased sharply between 2024 and 2025**, even as the total number of compromised patient records declined, suggesting attackers are increasingly prioritizing **operational disruption** over mass data theft. Drivers cited include **ransomware**, **third‑party/vendor exposure**, and expanding “shadow AI” usage; the same reporting highlights low confidence in vendor risk assessments and in rapid detection/containment/recovery capabilities, reinforcing the need for improved visibility across overlapping technology stacks and more resilient security programs. Separately, the U.S. **HHS Office for Civil Rights (OCR)** stated it will continue HIPAA privacy/security enforcement despite federal office closures, and outlined 2026 priorities that include: continuing the **HIPAA Right of Access** initiative, expanding **Security Rule risk analysis** work into risk management, and emphasizing enforcement actions tied to **hacking and ransomware** (described as the leading driver of large breaches reported to OCR). OCR also noted preparation for a new enforcement program related to confidentiality of substance use disorder treatment records under **42 C.F.R. Part 2**, with breach reports and complaints expected to begin in February 2026.
Jun 29, 2026
European regulators issued about **€1.2B in GDPR fines in 2025** and received an average of **443 personal data breach notifications per day**, according to DLA Piper’s GDPR Fines and Data Breach Survey. The report attributes the sustained reporting surge to multiple factors—geopolitical instability, repeated cyber incidents, and commoditized attack tooling—while warning that organizations are also contending with overlapping and faster disclosure expectations under newer regimes such as **NIS2** and **DORA**, increasing operational and management-level accountability pressure. In the US healthcare sector, HHS **OCR** used its 2026 quarterly cybersecurity newsletter to urge **HIPAA-regulated entities** to harden systems, standardize security controls, reduce attack surface, and strengthen **risk analysis and risk management**, signaling continued enforcement focus on Security Rule compliance. Separately, OCR breach-portal reporting showed **unusually low counts** of large healthcare breaches in October–November 2025 that likely reflect a **government shutdown backlog** rather than a true decline, while individual incidents continued to surface—**Central Maine Healthcare** reported unauthorized network access from **March–June 2025** affecting up to **145,000** individuals, with exposed data including **names and Social Security numbers** plus treatment/insurance-related information and credit monitoring offered to impacted patients.
Jul 12, 2026
The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (**OCR**) reached a **$103,000** settlement with Illinois-based substance use disorder provider **Top of the World Ranch Treatment Center** to resolve alleged noncompliance with the **HIPAA Security Rule** risk analysis requirement. OCR characterized the action as its first financial penalty of the year and part of its ongoing enforcement initiative focused on organizations that fail to conduct an *accurate and thorough* risk analysis to identify risks to the confidentiality, integrity, and availability of **electronic protected health information (ePHI)**. OCR opened the investigation after the provider reported a **March 2023** breach tied to a **phishing attack** that enabled unauthorized access to ePHI via a workforce member’s email account, with **1,980 patients** potentially affected. In addition to the monetary payment, the resolution requires a **two-year corrective action plan** including completion of a comprehensive risk analysis, implementation of a risk management plan, updated written HIPAA policies and procedures (Privacy, Security, and Breach Notification Rules), and annual workforce training; OCR cited broader sector trends of rising hacking-related breach reports as context for the risk-analysis enforcement focus.
Jun 29, 2026