HHS Civil Rights Office Reports Record HIPAA Enforcement in FY2025: 1,037 Actions, Over $868 Million
Washington — The Office for Civil Rights (OCR) at the Department of Health and Human Services (HHS) released its fiscal year 2025 enforcement annual report on October 19: the office took 1,037 enforcement actions during the year and collected more than $868 million in settlements and civil penalties, both record highs. Those subject to enforcement included hospitals, health plans, clinics and third-party vendors handling protected health information under the Health Insurance Portability and Accountability Act (HIPAA).
According to the report, the 1,037 actions rose about 72 percent from 604 in fiscal 2024, and total settlements and penalties rose about 65 percent from $525 million; the average settlement per matter was about $1.184 million. The largest single resolution of the year was a $2.75 million settlement with UnitedHealth Group over a major data breach. Laboratory Corporation of America, PH&C LLC, Rudra LLC, and physicians Dr. Richard Kim and Mark White were also named among the year's resolutions.
OCR enforces HIPAA's privacy, security and breach-notification rules. The report urged organizations holding protected health information such as patient records to review their data-security and privacy compliance; concerns can be reported through the office's voluntary disclosure channel at [email protected], and organizations that identify violations may, under the voluntary self-disclosure protocol, report and correct the problem within 60 days and reach a resolution with OCR.
Published by GSM · USA (original Chinese edition)
Photo: 图：位于华盛顿的卫生与公众服务部总部汉弗莱大楼入口（2026年10月12日摄）。G. Edward Johnson 摄，CC BY 4.0，经 Wikimedia Commons 发布。
