Loading story…
The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) announced a settlement with MMG Fusion, LLC, a Maryland-based software provider to oral healthcare organizations acting as a HIPAA business associate, over alleged violations of the HIPAA Privacy, Security, and Breach Notification Rules tied to an unreported breach impacting approximately 15 million individuals. OCR’s investigation found that an unauthorized actor accessed MMG’s internal systems in December 2020, obtained protected health information (PHI)—including names, phone numbers, mailing and email addresses, dates of birth, and appointment dates/times—and that the data was exfiltrated and later posted on the dark web; OCR opened the case after receiving a complaint in early 2023 rather than a breach report from MMG.
According to OCR’s findings, MMG Fusion allegedly failed to perform a comprehensive risk analysis prior to the incident and did not provide required breach notifications to affected covered entities. Under the resolution agreement, MMG agreed to a corrective action plan (with OCR monitoring for three years) and paid $10,000, with OCR noting MMG’s financial condition as a factor in the settlement amount. Separate HIPAA compliance guidance content on designated record sets is not part of the enforcement action and does not add incident-specific details.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
On March 5, 2026, OCR announced a settlement over the MMG Fusion breach, requiring a $10,000 payment and a corrective action plan monitored for three years. OCR alleged failures including inadequate risk analysis, impermissible disclosure of PHI, and failure to notify affected covered entities, with HiQOR Dental signing as successor-in-interest.
In March 2023, OCR formally opened an investigation into MMG Fusion following the complaint about the unreported breach and dark web exposure of PHI. The investigation examined possible violations of the HIPAA Privacy, Security, and Breach Notification Rules.
In January 2023, HHS' Office for Civil Rights received a complaint alleging that MMG Fusion had not reported the security incident and that PHI had been exposed. The complaint triggered federal scrutiny of the company’s breach handling.
After the 2020 intrusion, the stolen PHI from MMG Fusion was posted on the dark web. OCR later cited the dark web posting as part of the unreported security incident.
On December 21, 2020, an unauthorized actor accessed MMG Fusion's internal network and exfiltrated protected health information. The incident ultimately affected about 15 million individuals, with exposed data including contact details, appointment information, and in some reports dates of birth.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
govinfosecurity.com
Open sourcebankinfosecurity.com
Open sourcehipaajournal.com
Open sourcedatabreaches.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Department of Health and Human Services Office for Civil Rights announced HIPAA enforcement settlements against **Assured Imaging Affiliated Covered Entities, Axia Women’s Health, Star Group, L.P. Health Benefits Plan, and Consociate Health** after ransomware-related breaches exposed the electronic protected health information of about **427,000 individuals**. OCR said the cases shared the same core failure: deficient or nonexistent security risk analysis under the HIPAA Security Rule, and each organization agreed to a corrective action plan with **two years of federal monitoring**. The settlements totaled **about $1.7 million** across the four cases, with reports also citing **$1,165,000 in penalties** as part of the enforcement actions. OCR said a HIPAA gap assessment is not a substitute for a formal risk analysis and warned that unresolved known risks can increase liability after a breach. Regulators and experts said covered entities should inventory all systems holding `ePHI`, assess threats and vulnerabilities, assign and track risk remediation, and strengthen controls such as access management, audit logging, encryption, incident response planning, and workforce training.
Jun 29, 2026
The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (**OCR**) reached a **$103,000** settlement with Illinois-based substance use disorder provider **Top of the World Ranch Treatment Center** to resolve alleged noncompliance with the **HIPAA Security Rule** risk analysis requirement. OCR characterized the action as its first financial penalty of the year and part of its ongoing enforcement initiative focused on organizations that fail to conduct an *accurate and thorough* risk analysis to identify risks to the confidentiality, integrity, and availability of **electronic protected health information (ePHI)**. OCR opened the investigation after the provider reported a **March 2023** breach tied to a **phishing attack** that enabled unauthorized access to ePHI via a workforce member’s email account, with **1,980 patients** potentially affected. In addition to the monetary payment, the resolution requires a **two-year corrective action plan** including completion of a comprehensive risk analysis, implementation of a risk management plan, updated written HIPAA policies and procedures (Privacy, Security, and Breach Notification Rules), and annual workforce training; OCR cited broader sector trends of rising hacking-related breach reports as context for the risk-analysis enforcement focus.
Jun 29, 2026
Several healthcare organizations are resolving class-action litigation tied to alleged exposure of sensitive patient data, with settlements emphasizing cost avoidance rather than admissions of wrongdoing. **Kaiser Permanente** agreed to a **$46 million** settlement over claims that patient interactions with certain Kaiser websites and digital tools resulted in personal health information being transmitted to third parties (including **Google, Microsoft Bing, Twitter/X, and Adobe**) via online tracking/advertising technologies; the allegations focus on web/digital activity rather than Kaiser’s core electronic medical record systems, and the proposed class period spans **2017–2024**. Separately, two healthcare entities reached settlements following **network intrusions** that allegedly exposed protected health information and other sensitive identifiers. **Mystic Valley Elder Services** agreed to pay **$520,000** to settle claims stemming from an **April 2024** incident in which attackers accessed its network and potentially obtained data including SSNs, financial/payment data, credentials, and medical/insurance information affecting **~89,600** people; plaintiffs also alleged delayed detection and notification. **Consulting Radiologists Ltd.** received approval for a **$2.2 million** settlement after a 2024 intrusion affecting up to **583,824** individuals, with allegations including inadequate security controls and delayed breach notification; the organization reported that some impacted records included medical/insurance data and SSNs (for a subset of individuals).
Jun 29, 2026