October 29, 2026
Lehigh Valley Health Network settles ransomware investigation for $800,000
What happened. Lehigh Valley Health Network agreed to pay $800,000 and adopt a corrective action plan. HIPAA Journal reports the ransomware attack exposed the PHI of 248,359 people. OCR cited three failures: no accurate risk analysis, no regular review of system activity records such as audit logs, and late notice to patients.
What it means for a small practice. You do not need a hospital budget to fix the first two. You need a risk analysis that is accurate, and a named person who reviews access logs on a schedule. Both are required by the Security Rule (45 CFR 164.308(a)(1)(ii)(A) and (D)).
Sources: OCR enforcement list / HIPAA Journal
October 8, 2026
Dental practice Shen Smiles settles Privacy Rule investigation for $140,000
What happened. Dr. Linda L. Shen, doing business as Shen Smiles, P.C., settled a HIPAA Privacy Rule investigation with OCR. HIPAA Journal reports the amount as $140,000.
What it means for a small practice. This is a dental practice, not a health system. HIPAA has no small practice exemption. If your office is a covered entity, the Privacy Rule applies to you the same way.
Sources: OCR enforcement list
September 17, 2026
Ambry Genetics settles phishing breach investigation for $700,000
What happened. Ambry Genetics agreed to pay $700,000 and adopt a corrective action plan. HIPAA Journal reports a phishing email gave an outsider access to an employee email account, exposing the ePHI of 225,370 people. OCR cited no accurate risk analysis and no procedures for ending access when staff leave.
What it means for a small practice. Check one thing this week. When someone leaves your practice, who turns off their logins, and how fast? Write that down as a procedure (45 CFR 164.308(a)(3)(ii)(C)).
Sources: OCR enforcement list / HIPAA Journal
August 27, 2026
Azul Vision settles Right of Access investigation for $50,000
What happened. Azul Vision, Inc. settled a HIPAA Right of Access investigation with OCR. HIPAA Journal reports the amount as $50,000.
What it means for a small practice. When a patient asks for their records, the clock starts. You must act within 30 days of the request, and one 30 day extension is allowed if you tell the patient why in writing (45 CFR 164.524(b)(2)). Log every request and the date you answered it.
Sources: OCR enforcement list
July 29, 2026
OSF Healthcare System settles ransomware investigation for $552,250
What happened. OSF Healthcare System agreed to pay $552,250. The agreement names a risk analysis failure, an impermissible disclosure of the PHI of 53,907 people, and late notification to patients and to HHS.
What it means for a small practice. Late notice is its own violation, separate from the breach. Individual notice is due without unreasonable delay and no later than 60 calendar days after discovery (45 CFR 164.404(b)). Know that deadline before you need it.
Sources: OCR enforcement list