Loading story…
The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) reached a $103,000 settlement with Illinois-based substance use disorder provider Top of the World Ranch Treatment Center to resolve alleged noncompliance with the HIPAA Security Rule risk analysis requirement. OCR characterized the action as its first financial penalty of the year and part of its ongoing enforcement initiative focused on organizations that fail to conduct an accurate and thorough risk analysis to identify risks to the confidentiality, integrity, and availability of electronic protected health information (ePHI).
OCR opened the investigation after the provider reported a March 2023 breach tied to a phishing attack that enabled unauthorized access to ePHI via a workforce member’s email account, with 1,980 patients potentially affected. In addition to the monetary payment, the resolution requires a two-year corrective action plan including completion of a comprehensive risk analysis, implementation of a risk management plan, updated written HIPAA policies and procedures (Privacy, Security, and Breach Notification Rules), and annual workforce training; OCR cited broader sector trends of rising hacking-related breach reports as context for the risk-analysis enforcement focus.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
On February 19, 2026, HHS OCR announced a settlement with Top of the World Ranch Treatment Center over the alleged HIPAA Security Rule violation. The provider agreed to pay $103,000 and adopt a two-year corrective action plan requiring risk analysis, risk management, updated policies and procedures, and annual workforce training.
After receiving the breach report, HHS OCR opened an investigation into Top of the World Ranch Treatment Center's compliance with the HIPAA Security Rule. OCR later determined it could not obtain evidence that the provider had conducted an accurate and thorough risk analysis before the breach.
In March 2023, Top of the World Ranch Treatment Center reported the breach to HHS OCR, stating that a successful phishing attack resulted in unauthorized access to ePHI through a workforce member's email account. The report triggered federal scrutiny of the incident.
On November 17, 2022, a phishing incident led a Top of the World Ranch Treatment Center employee to disclose credentials, allowing unauthorized access to a business email account for several hours. Electronic protected health information for 1,980 individuals was potentially exposed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
hipaajournal.com
Open sourcedatabreaches.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Department of Health and Human Services Office for Civil Rights announced HIPAA enforcement settlements against **Assured Imaging Affiliated Covered Entities, Axia Women’s Health, Star Group, L.P. Health Benefits Plan, and Consociate Health** after ransomware-related breaches exposed the electronic protected health information of about **427,000 individuals**. OCR said the cases shared the same core failure: deficient or nonexistent security risk analysis under the HIPAA Security Rule, and each organization agreed to a corrective action plan with **two years of federal monitoring**. The settlements totaled **about $1.7 million** across the four cases, with reports also citing **$1,165,000 in penalties** as part of the enforcement actions. OCR said a HIPAA gap assessment is not a substitute for a formal risk analysis and warned that unresolved known risks can increase liability after a breach. Regulators and experts said covered entities should inventory all systems holding `ePHI`, assess threats and vulnerabilities, assign and track risk remediation, and strengthen controls such as access management, audit logging, encryption, incident response planning, and workforce training.
Jun 29, 2026
The U.S. Department of Health and Human Services (HHS) **Office for Civil Rights (OCR)** announced a settlement with **MMG Fusion, LLC**, a Maryland-based software provider to oral healthcare organizations acting as a HIPAA business associate, over alleged violations of the **HIPAA Privacy, Security, and Breach Notification Rules** tied to an **unreported breach** impacting approximately **15 million individuals**. OCR’s investigation found that an unauthorized actor accessed MMG’s internal systems in **December 2020**, obtained protected health information (PHI)—including names, phone numbers, mailing and email addresses, dates of birth, and appointment dates/times—and that the data was **exfiltrated and later posted on the dark web**; OCR opened the case after receiving a complaint in early 2023 rather than a breach report from MMG. According to OCR’s findings, MMG Fusion allegedly failed to perform a comprehensive risk analysis prior to the incident and did not provide required breach notifications to affected covered entities. Under the resolution agreement, MMG agreed to a **corrective action plan** (with OCR monitoring for **three years**) and paid **$10,000**, with OCR noting MMG’s financial condition as a factor in the settlement amount. Separate HIPAA compliance guidance content on designated record sets is not part of the enforcement action and does not add incident-specific details.
Jun 29, 2026
Group Health Cooperative of South Central Wisconsin agreed to a $3.5 million settlement to resolve a class action lawsuit following a data breach that exposed the protected health information (PHI) of over 533,000 individuals. The breach, detected in January 2024, involved unauthorized access to sensitive data including names, Social Security numbers, and Medicare/Medicaid numbers. The settlement, which has received preliminary court approval, will compensate affected class members and was reached to avoid the costs and risks of continued litigation, with the defendant denying any wrongdoing. Separately, Concentra Inc. settled with the U.S. Department of Health and Human Services Office for Civil Rights (OCR) for $112,500 over a HIPAA Right of Access violation, after failing to provide a patient with timely access to their medical records despite multiple requests. This enforcement action is part of an ongoing OCR initiative targeting noncompliance with the HIPAA Privacy Rule's right of access provision. These cases highlight the significant financial and legal consequences for healthcare organizations that fail to adequately protect patient data or comply with HIPAA requirements.
Jul 12, 2026