HHS Secures Six-Figure HIPAA Settlements With Employer

HIPAA doesn't apply to just hospitals and large health insurers. Most employer- group health plans are covered entities under HIPAA and are squarely within the HHS Office for Civil Rights' (OCR) enforcement crosshairs.

Group health plans must independently comply with HIPAA. Generally, group health plans are treated as separate legal entities from the employers/plan sponsors and must conduct their own Security Rule risk analysis, implement Privacy, Security, and Breach Notification Rule policies and procedures, amend plan documents to incorporate HIPAA requirements, and implement safeguards, regardless of whether the employer or plan sponsor has its own electronic protected health information (ePHI) or information security program.

The Security Rule risk analysis is non-negotiable. Failure to conduct the risk analysis is one of the most frequently cited violations in OCR enforcement actions.

OCR evaluates compliance as of the date of the breach. Remediating after a breach will not prevent an enforcement action for pre-breach noncompliance.

Proactive is better than reactive. Proactive HIPAA compliance is far less costly and burdensome than post-enforcement penalties, settlements, and corrective action plans under OCR oversight.

Employer- group health plans are independently subject to HIPAA's Privacy, Security, and Breach Notification Rules, including specific requirements to conduct a Security Rule risk analysis, implement comprehensive policies and procedures, and maintain HIPAA-compliant plan documentation. Many plan sponsors might assume that these obligations are handled by their third-party administrators, insurers, or corporate IT departments, but OCR's recent enforcement activity reinforces that the plan will be held accountable. OCR has been actively enforcing these requirements against group health plans through its Risk Analysis Initiative, imposing significant monetary payments and multiyear corrective action plans on plans that lacked required safeguards before a cyberattack occurred. Notably, in both of the settlements discussed below, the ransomware attacks occurred in 2021, yet the resolutions were not announced until 2026, which underscores that OCR measures compliance as of the date of the incident and that enforcement exposure can persist for years after a breach.

Below, we summarize OCR's recent enforcement actions against employer- group health plans and then outline what HIPAA requires of these plans and the practical steps plan sponsors can take now to ensure compliance.

OCR's Risk Analysis Initiative: Recent Enforcement Actions

OCR has made clear that the risk analysis requirement is an enforcement priority. Since launching its Risk Analysis Initiative, OCR has completed more than a dozen investigations resulting in settlements or civil money penalties for regulated entities that failed to conduct the required risk analysis. As OCR Director Paula M. Stannard has stated: "Hacking and ransomware are the most frequent type of large breach reported to OCR. Proactively implementing the HIPAA Security Rule before a breach or an OCR investigation not only is the law but also is a regulated entity's best opportunity to prevent or mitigate the harmful effects of a successful cyberattack."

The following two recent settlements highlight OCR enforcement against group health plans that suffered ransomware cyberattacks.

Spencer Gifts LLC Flexible Benefits and Welfare Benefit Plans

Spencer Gifts LLC Flexible Benefits and Welfare Benefit Plans (employer- group health plan of a national retail company)

November 2021: Unauthorized actor accessed company network and deployed ransomware, encrypting data on servers storing the plan's PHI

Names, addresses, zip codes, phone numbers, email addresses, and Social Security numbers

$450,000 plus two-year corrective action plan

(1) Failure to conduct an accurate and thorough risk analysis; (2) failure to implement reasonable and appropriate policies and procedures

The corrective action plan requires the group health plan to conduct and document a risk analysis, review and revise its HIPAA policies and procedures, and train workforce members with access to protected health information (PHI). This settlement marked OCR's 20th ransomware enforcement action and its 14th enforcement action under the Risk Analysis Initiative.

Star Group, L.P. Health Benefits Plan

April 23, 2026 (announced as part of four simultaneous settlements totaling $1,165,000)

Star Group, L.P. Health Benefits Plan (self-funded employee benefits plan of a Connecticut-based energy provider)

Unauthorized actor deployed ransomware and exfiltrated PHI from the plan

Names, addresses, dates of birth, Social Security numbers, health insurance information (member ID numbers, claims data, benefit selection information)

$245,000 plus two-year corrective action plan

(1) Impermissible disclosure of PHI (45 C.F.R. § 164.502(a)); (2) failure to conduct an accurate and thorough risk analysis (45 C.F.R. §164.308(a)(1)(ii)(A))

This settlement required a full risk analysis ePHI across all electronic equipment, data systems, and applications; a complete inventory of all systems containing ePHI; documentation on network segmentation, vulnerability scanning, logging and alerts, and patch management; a review of adequate separation between the plan sponsor and the group health plan; an enterprisewide risk management plan; and workforce training.

Building a HIPAA-Compliant Group Health Plan: Requirements and Practical Steps

Having a current risk analysis and HIPAA policies and procedures in place before a privacy or security incident occurs delivers significant practical benefits. Plans that already have identified their vulnerabilities through a thorough risk analysis, implemented security safeguards, and established incident response protocols through documented policies and procedures are better positioned to detect threats earlier, contain breaches faster, and reduce the financial and operational impact of an incident.

Most employer- group health plans are "covered entities" under HIPAA and are independently responsible for complying with the Privacy, Security, and Breach Notification Rules. While many employer- group health plans contract with third-party administrators (TPAs) to perform many of the administrative functions of the plan, the plan sponsor is likely responsible for the plan's overall HIPAA compliance obligations. Plan sponsors should consider confirming that their group health plans have the following in place:

Updated Comprehensive HIPAA Security Rule Risk Analysis. The Security Rule requires covered group health plans to "[c]onduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity" ( 45 C.F.R. § 164.308(a)(1)(ii)(A) ). The risk analysis should identify systems creating, receiving, maintaining, or transmitting ePHI; map how ePHI enters, flows through, and exits those systems; assess potential threats and vulnerabilities; evaluate current security measures; determine the likelihood and impact of potential risks; and document all findings. The risk analysis must be documented and periodically updated and should be specific to the group health plan's ePHI, not merely a general corporate IT assessment.

Risk Management Plan. Based on the risk analysis findings, the plan should implement security measures sufficient to reduce identified risks and vulnerabilities to a reasonable and appropriate level, as required by 45 C.F.R. § 164.308(a)(1)(ii)(B) .

HIPAA Policies and Procedures. The Security Rule requires covered plans to "[i]mplement reasonable and appropriate policies and procedures to comply with the standards, implementation specifications, or other requirements" of the Security Rule ( 45 C.F.R. § 164.316(a) ), and the Privacy Rule separately requires covered plans to "implement policies and procedures with respect to [PHI] that are designed to comply with" the Privacy Rule standards ( 45 C.F.R. § 164.530(i) ). A group health plan generally should have implemented, and updated as needed, policies and procedures addressing Privacy Rule requirements, Security Rule standards (including access controls, audit controls, integrity, transmission security, security incident procedures, and contingency planning), and Breach Notification Rule obligations.

Updated Plan Documentation. Before a group health plan may disclose PHI to the plan sponsor for plan administration purposes, the plan documents must incorporate the provisions required by 45 C.F.R. § 164.504(f) , including provisions establishing the permitted and required uses and disclosures of PHI by the plan sponsor, requiring the plan sponsor to certify that the plan documents incorporate the required provisions, providing for adequate separation between the plan and the plan sponsor (commonly known as "firewall" provisions), and restricting access to and use of PHI to designated plan sponsor employees performing plan administration functions. The Security Rule's organizational requirements ( 45 C.F.R. § 164.314(b) ) further require that plan documents obligate the plan sponsor to implement administrative, physical, and technical safeguards that reasonably and appropriately protect ePHI; ensure that adequate separation is supported by reasonable and appropriate security measures; ensure that any agent to whom it provides ePHI agrees to implement reasonable and appropriate security measures; and report to the plan any security incident of which it becomes aware.

Workforce Training. The plan should provide and document HIPAA training specific to the group health plan's operations, covering privacy and security policies and procedures, permissible uses and disclosures, individuals' privacy rights, and breach reporting obligations.

Ongoing Compliance Processes. The plan should establish periodic risk analysis updates, regular policy reviews, information system activity monitoring, and audit controls. HIPAA compliance requires continuous attention and periodic reassessment.