HIPAA Fines

On March 5, 2026, the Office for Civil Rights (OCR) announced a settlement with MMG Fusion LLC, a software company that helps healthcare organizations communicate with patients. The settlement addresses a data breach that exposed the protected health information (PHI) of about 15 million people.

When we discuss HIPAA most of the articles have been on security and breaches, but HIPAA goes well beyond privacy and Security.  One aspect of the HIPAA rule is the “Right of Access”.   OCR (The Office for Civil Rights – the branch of HHS the enforces HIPAA) is enforcing this law even more strongly since the 21 Century Cures Act was published.  OCR has begun to levy fines against organizations that are in violation of the “Right of Access” rule.