The Department of Health and Human Services (HHS) Office for Civil Rights (OCR) has announced its first financial penalty of the year to resolve an alleged violation of the HIPAA Rules. Top of the World Treatment Center, a Milan, Illinois-based addiction treatment provider, has agreed to pay a $103,000 financial penalty to settle an allegation that it violated the risk analysis requirement of the HIPAA Security Rule.

The number of data breaches reported to OCR involving hacking increased by 239% between 2018 and 2023, and hacking incidents have continued to be reported in high numbers since. In an effort to improve healthcare cybersecurity and reduce the number of successful hacking incidents, OCR launched an enforcement initiative targeting noncompliance with a specific requirement of the HIPAA Security Rule – the risk analysis. The risk analysis is one of the most important HIPAA requirements for improving security.

The enforcement initiative is intended to make it harder for hackers to succeed by ensuring that the vulnerabilities they exploit to gain access to healthcare networks are identified and addressed in a timely manner. OCR’s HIPAA compliance audits and data breach investigations consistently uncovered risk analysis failures, including failures to conduct a risk analysis and incomplete risk analyses. If healthcare organizations do not conduct a comprehensive, organization-wide risk analysis to identify all risks to the confidentiality, integrity, and availability of electronic protected health information (ePHI), risks and vulnerabilities will remain and can potentially be exploited by hackers.

Including the latest penalty, OCR has resolved 11 investigations of ePHI breaches with settlements or civil monetary penalties for alleged violations of the risk analysis provision of the HIPAA Security Rule. “In a time where health care providers and other HIPAA-regulated entities are facing unprecedented cybersecurity threats, compliance with the HIPAA Risk Analysis provision is more essential than ever,” said OCR Director Paula M. Stannard. “Covered entities and business associates cannot protect electronic protected health information if they haven’t identified potential risks and vulnerabilities to that health information.”

The incident that prompted OCR’s investigation of Top of the World Treatment Center was a phishing incident. An employee was tricked by a phishing email into disclosing their credentials, which allowed a hacker to access a single business email account for several hours on November 17, 2022. The email account was reviewed and found to contain the ePHI of 1,980 individuals, including their names, Social Security numbers, diagnosis information, treatment information, and health insurance information.

OCR investigated and could not be provided with evidence to confirm that a HIPAA-compliant risk analysis had been conducted prior to the data breach, in violation of 45 C.F.R. § 164.308(a)(1)(ii)(A) of the HIPAA Security Rule. Under the current enforcement initiative, financial penalties will be imposed for risk analysis failures. OCR notified Top of the World Treatment Center of its intention to impose a financial penalty to address the alleged violation, and offered to settle the alleged violation informally. Settlements involve a reduced financial penalty, although the HIPAA-regulated entity must adopt a corrective action plan.

Top of the World Treatment Center is required to conduct a comprehensive, organization-wide risk analysis to identify all risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI. Based on the risk analysis, a risk management plan must be developed and implemented to reduce all identified risks and vulnerabilities to a low and acceptable level. After the initial risk analysis, Top of the World Treatment Center must conduct an accurate and thorough risk analysis at least annually, and subject risks to a HIPAA-compliant risk management process.

Further, policies and procedures must be developed, implemented, and maintained to comply with the HIPAA Rules, specifically covering risk analyses, risk management, information system activity reviews, and breach notifications. The new policies must be distributed to the workforce, training materials must be developed (and approved by OCR), and HIPAA training must be provided to the workforce.

The post Top of the World Treatment Center Settles Alleged Risk Analysis HIPAA Violation appeared first on The HIPAA Journal.

A $182,000 settlement has been agreed between the HHS’ Office for Civil Rights and five Delaware healthcare providers to resolve alleged violations of the HIPAA Privacy and HIPAA Breach Notification Rules. The settlement concerns the posting of patients’ protected health information (PHI) on social media without first obtaining HIPAA-compliant authorizations to use PHI for a purpose not expressly permitted by the HIPAA Privacy Rule, then failing to notify individuals about the impermissible use and disclosure.

Cadia Healthcare is a provider of rehabilitation, skilled nursing, and long-term care services at five facilities in Delaware. Those facilities are Cadia Rehabilitation Broadmeadow in Middletown, Cadia Rehabilitation Renaissance in Millsboro, Cadia Rehabilitation Capital in Dover, and Cadia Rehabilitation Pike Creek and Cadia Rehabilitation Silverside in Wilmington, collectively referred to as the Cadia Healthcare Facilities (Cadia).

Each of the Cadia facilities is a HIPAA-covered entity that is required to comply with the HIPAA Rules. OCR launched an investigation after receiving a complaint on September 20, 2021, about an alleged impermissible disclosure of PHI online.  The complainant alleged that Cadia had used their photograph, name, and information about their condition, treatment, and recovery in an online post but had not obtained authorization to use the information for that purpose.

OCR’s investigation substantiated the allegation and determined that a Cadia employee had posted the patient’s PHI to Cadia’s social media page as part of a success story; however, a signed authorization form had not been obtained prior to that use and disclosure. Under HIPAA, PHI cannot be posted online on websites or social media pages unless a HIPAA-compliant authorization has been obtained from an individual in advance.

OCR notified Cadia about the allegations and the findings of the investigation, and Cadia removed the post and notified the patient that the success story had been removed. OCR also identified other patients whose treatment had been included in a series of success stories. As of February 22, 2022, Cadia had created and posted success stories containing the PHI of 150 patients without obtaining valid HIPAA authorizations. According to OCR, Cadia shut down the success story program in March 2022, but failed to issue notifications to the affected individuals, as required by the HIPAA Breach Notification Rule.

“The internet and social media are important business development tools.  But before disclosing PHI through social media or public-facing websites, covered entities and business associates should ensure that the HIPAA Privacy Rule permits the disclosure,” said OCR Director Paula M. Stannard. “Generally, a valid, written HIPAA authorization from an individual is necessary before a covered entity or business associate can post that individual’s PHI in a website testimonial or through a social media campaign.”

In April 2025, OCR entered into a settlement agreement with Cadia to resolve the alleged violations of the HIPAA Rules.  The alleged violations related to two Privacy Rule and one Breach Notification Rule provisions:

• 45 C.F.R. § 164.530(c) – The failure to implement appropriate administrative, technical, and physical safeguards to protect the privacy of PHI and reasonably safeguard PHI from any intentional or unintentional use or disclosure.
• 45 C.F.R. § 164.502(a) – The impermissible use or disclosure of PHI
• 45 C.F.R. § 164.404(a) – The failure to issue timely breach notifications

In addition to paying the financial penalty, the settlement agreement includes a corrective action plan (CAP). Cadia will be monitored for compliance with the CAP for 2 years. The corrective action plan requires Cadia to review and revise, as necessary, its policies and procedures to ensure compliance with the HIPAA Rules. Those policies and procedures must be distributed to the workforce, and HIPAA training must be provided to workforce members. Policies and procedures must be reviewed at least annually and updated as necessary to ensure continued HIPAA compliance. Cadia is also required to issue breach notifications concerning the impermissible disclosures of PHI under the success story program.

Notifications have already been issued, and the Cadia websites currently display a notice about the privacy violations. Cadia confirmed that it had policies and procedures in place requiring patients to sign a written consent form prior to using their information in its success story program. “On February 22, 2022, we learned that one or more of these success stories may have been posted without a valid consent form on file for the patient highlighted in the story. We promptly launched an investigation, removed all success stories from our social media pages, and on March 2, 2022, eliminated the success story program in its entirety,” explained Cadia in its substitute breach notice. “Because we deleted all success stories in 2022, we were unable to definitively determine all individuals who participated in the success story program. Accordingly, out of an abundance of caution, we are notifying individuals who may have participated and for whom we could not locate a valid consent form.”

This is the 20^th HIPAA penalty to be imposed by OCR to resolve violations of the HIPAA Rules so far in 2025, making it one of the most active years of HIPAA enforcement. So far this year, OCR has collected more than $8.2 million in civil monetary penalties and settlements.

The post Delaware Rehab Facilities Settle Social Media and Breach Notification HIPAA Violations appeared first on The HIPAA Journal.