HIPAA Enforcement Action Against Employer-Sponsored Health Plan for Ransomware Attack

On April 23, 2026, the HHS’s Office for Civil Rights (“OCR”) announced a settlement with a self-funded employer-sponsored group health plan (the “Plan”) following a ransomware attack that resulted in a breach of electronic protected health information (“PHI”). Under the settlement, the Plan agreed to pay $245,000 to OCR and to implement a two-year corrective action plan.... By: Haynes Boone