Inflation Strikes on Eggs and OSHA Fines

January 13, 2023

To keep up with inflation and the ever-changing cost-of-living adjustments, the U.S. Department of Labor announced changes to Occupational Safety and Health Administration (OSHA) civil penalty amounts today.

As part of a Congressional act passed in 1990, the Federal Civil Penalties Inflation Adjustment Act, and amended by the Federal Civil Penalties Inflation Adjustment Act Improvements Act of 2015, the Department completes an annual review by January 15th to evaluate and adjust civil money penalty levels against inflation. 

We can expect the new penalty amounts, shown below, to take effect on January 17, 2023. Currently, penalties for serious and other-than-serious violations are $14,502 per violation. With the recent update, we are seeing over a $1,000 increase to $15,625. Repeated violations aren’t getting a break either with an increase to $156,259 per violation from the previous $145,027. 

Type of Violation Penalty
Serious
Other-Than-SeriousPosting Requirements		 $15,625 per violation
Failure to Abate $15,625 per day beyond the abatement date
Willful or Repeated $156,259 per violation 

Curious about state-specific updates? Per the U.S. Department of Labor, states that operate their own OSHA Plans are required to adopt maximum penalty levels that are at least as effective as Federal OSHA’s. State Plans are not required to impose monetary penalties on state and local government employers. 

This new rule goes into effect on January 15, 2023. It will apply to any penalties assessed after January 15, 2023. 

Before you go egging the next OSHA enforcement officer you come in contact with, remember that these annual updates are in place to remind you of the importance of maintaining a safe and healthful work environment.

RECENT POSTS

Related posts

OCR Ransomware Settlements
Abyde News, Fines, HIPAA

OCR Ransomware Settlements: 4 Massive HIPAA Fines from April 2026 & How to Avoid Them

May 4, 2026 No comments yet

May 4, 2026   Quick Guide:  The Office for Civil Rights (OCR) just issued a massive wake-up call, announcing four simultaneous settlements totaling $1,165,000. The Stats You Need to Know 76%: The percentage of large healthcare breaches now caused by hacking/IT incidents. 427,000+: Total number of patients impacted across these four recent settlements. 264%: The increase in ransomware-related breaches reported to the OCR since 2018. The Office for Civil Rights (OCR) just announced a flurry of investigation settlements. At the root of the four that were announced: ransomware. Ransomware attacks continue to target healthcare facilities. As of last year, the OCR discovered that 76% of large breaches are due to hacking and IT shortcomings. Unfortunately, healthcare information is a goldmine for hackers, exposing sensitive data that can lead to identity theft, financial fraud, and compromised patient care. Breakdown & Lessons Learned Regional Women’s Health Group (Axia) The first settlement was regarding the Regional Women’s Health Group (Axia), an OBGYN network across five states. In this case, the organization submitted a breach report following a cyberattack that exposed over 37,000 patients. The settlement resulted in a $320,000 fine and a 2-year Corrective Action Plan (CAP). The Lesson: The OCR didn’t just fine them for being hacked; they reached a settlement because the healthcare organization failed to conduct a “thorough and accurate” Security Risk Analysis (SRA). If you don’t know where your vulnerabilities are, you can’t patch them. Unfortunately, hackers counted on this negligence and exploited it.  Assured Imaging This was the largest of the four fines, affecting a staggering 244,813 individuals. When a ransomware infection hit their servers, Assured Imaging, a medical imaging enterprise, reported a breach to the OCR. After a long investigation (the initial cyberattack occurred in 2020), and resulted in a $375,000 settlement and a 2-year CAP.  The Lesson: Beyond the initial ransomware attack, it was discovered that Assured had never completed an SRA. Additionally, the organization did not notify patients within 60 days of discovery of the breach. This is a direct violation of the Breach Notification Rule, which aims to allow patients to take control and mitigate risks as quickly as possible.  Consociate Health Consciate Health is the only Business Associate (BA) fine in the four. BAs continue to be under the OCR’s microscope, such as potentially needing to follow stricter requirements when handling patient data. Their breach started with a phishing attack that eventually led to the encryption of systems holding data for over 136,000 people. The BA discovered the ransomware six months after the initial phishing attack. Upon the OCR’s further investigation, the SRA was found to be insufficient. The organization paid a $225,000 settlement and entered into a 2-year CAP.  The Lesson: Human error (phishing) is the most common entry point for ransomware. Constant employee training is just as important as a strong firewall. Additionally, just because a BA doesn’t directly work with patients doesn’t mean it isn’t their responsibility to keep patient data secure.  SG Health Plan Even employee benefit plans are regulated under the Health Insurance Portability and Accountability Act (HIPAA). SG Health Plan, associated with a Connecticut energy provider, reported that the data of 9,316 members were exposed following a ransomware attack. It was discovered that the organization did not complete an extensive SRA. The benefit plan entered a settlement with the OCR for $245,000 and a 2-year CAP.  The Lesson: This settlement highlights that HIPAA applies to corporate health plans just as much as it does to traditional healthcare providers. Additionally, every organization that handles Protected Health Information (PHI) must complete an SRA.  The Bottom Line The OCR isn’t fining practices for ransomware attacks, but for being ill-prepared.  However, it is easier said than done to ensure your organization is secure in protecting patient data and complying with HIPAA.  Proactively implementing the HIPAA Security Rule is your opportunity to mitigate the impacts of a cyberattack. Waiting until the ransom note appears on your screen is a million-dollar mistake. Want to see what you might be missing?  Run a 5-Minute HIPAA Gap Assessment and protect your practice today! 

OSHA 2026 GHS Deadlines
Abyde News, Legislation, OSHA

2026 OSHA HazCom Deadlines: How the GHS Update Impacts Your Practice

March 23, 2026 No comments yet

March 23, 2026   Quick Guide: 2026–2028 OSHA HazCom Deadlines (as of March 2026) May 19, 2026: Deadline for manufacturers to update labels for pure substances. Nov 20, 2026: Deadline for practices to update written HazCom programs and staff training for substances. May 19, 2028: Final deadline for practices to be fully compliant for all mixtures (disinfectants, resins, etc.). If you came here after hearing that a major OSHA deadline is coming up in May 2026, then you can exhale. You aren’t late (yet)… although if you are reading this closer to November, you can panic [a little]. The changes are actually not terribly complex for your practice, as we will explain in this blog, so you can be prepared.   What is GHS, and why does it exist? The Globally Harmonized System can be thought of as a standardized or universal language that is aligned with GHS Revision 7. Since chemical manufacturing occurs all over the globe, something made in one country might use different warning symbols and formats than something made here in the U.S., which can be confusing, if not problematic, for those who use them.  OSHA is updating its standards so that every chemical label and Safety Data Sheet (SDS) uses the same icons (called pictograms) and formatting worldwide, helping your team to easily identify what is what, no matter where the product came from.   Why are there so many deadlines? There are really two different audiences for the deadlines: manufacturers and consumers of the chemicals. There are also two waves of chemical classes with different priorities: Pure Substances and Mixtures. Wave 1 – Pure Substances (Deadline: Nov 20, 2026) This first wave covers “pure” chemicals, or products that have only one main ingredient. For many practices, this list tends to be short including (but not limited to) medical gas – like 100% Oxygen or Nitrous Oxide, bulk alcohol – like 99% Isopropyl Alcohol, etc. Wave 2 – Mixtures (Deadline: May 19, 2028) Most products are likely “mixtures” of several chemicals. Because these are more complex to re-label, OSHA has given everyone until 2028 to reach full compliance. This includes most surface disinfectants, cleaners, clinical materials, etc. What if we mix things ourselves? Most mixtures you do in-house are probably to dilute other “mixtures” (ie: secondary container labeling). But say, for instance, you still mix your own amalgam – you have a unique situation where you’re dealing with two different deadlines. Your mercury needs updated labels by Nov 2026, but the alloy you’re mixing with would fit the mixture deadline, as would the final product.   When will we see changes? You might have heard about a May 19, 2026, deadline. That is the deadline for the manufacturers to have their pure substance labels ready. Here is when you can expect to see the changes in your orders: May 2026 (Manufacturer Deadline) New labels for pure substances. Nov 2027 (Manufacturer Deadline) New labels for all mixtures.   Should I be doing anything now? Just be aware of the changes and try to notice them. You may already see some manufacturers have these changes live; others may happen by the deadline. The key is effective Safety Data Sheet (SDS) management. When a new version of an SDS arrives, simply swap it out in your library (whether that’s a physical binder or stored digitally). Replacing them as they come in is much easier than doing a mass update in November. If you haven’t received new sheets for your pure substances by this summer, you can reach out to your vendor to request the GHS-aligned version. The other change you’ll notice is products adding the GHS hazard pictograms where previously they had none or few. When you spot these, show them to your team during a morning meeting and explain what each icon means. It’s a simple way to keep staff informed and safe. Beyond that, start thinking about updates to your OSHA Hazard Communication training.   Need Help? We get it, you didn’t get into healthcare to become an OSHA expert… But we did. If you want to stay up to date on the deadlines and get the easy button covered for OSHA compliance, our platform and our compliance experts are here to help you do exactly that. If you’d like to learn more about Abyde and how we can help, check out our OSHA for Healthcare platform.

Abyde News, Fines, HIPAA

One Patient Request, Years of Fallout: The Concentra Right of Access Case

December 22, 2025 No comments yet

December 22, 2025 Well, the Office for Civil Rights (OCR) is back, folks!  After a historic government shutdown, the OCR has announced its first fine.  The recipient of the latest fine is Concentra, Inc., a Texas-based enterprise healthcare provider. While this health organization might have numerous locations, the root of this federal fine and years of legal battles stems from one patient complaint to the OCR.  With the 21st fine of the year, we’re taking it back to the basics: Patient Right of Access.  What Happened?  In February 2018, a patient requested a copy of their medical and billing records from Concentra’s Peoria, Arizona, location. While a Concentra employee forwarded the request to the billing office, the patient did not receive their medical records in a timely manner. The patient sent several requests throughout the year.  In October 2018, Concentra’s Business Associate issued an invoice to the patient for $82.57 for the requested medical records. This amount was disputed.  After months of back-and-forth with Concentra, in December 2018, the patient filed a complaint with the OCR regarding how the healthcare provider handled their record request. Finally, in March 2019, over a year after the initial request, Concentra’s Business Associate provided the health records to the patient for an adjusted rate of $6.50.  Providing the records was just the beginning for Concentra. In the summer of 2020, the OCR notified the healthcare provider that this case indicated noncompliance with the Privacy Rule and provided Concentra with the opportunity to submit mitigating evidence.  Then, in 2021, the OCR proposed to levy a $250,000 penalty. After several more years of legal battles, the OCR settled this case in 2025 with a $112,500 settlement.  Patient Right of Access 101 This lengthy chain of events highlights the importance of promptly and thoroughly addressing patient requests.  Detailed in the Privacy Rule, patients have the right to access their health records within 30 days from the initial request, known as the Right of Access. This timely access empowers patients to make informed decisions about their healthcare. This 30-day timeline applies on the federal level. Depending on the state, your practice may be required to comply with more stringent timelines, as seen in California.  The 30-day timeline is firm, and a practice can only be granted an extension once, for an additional 30 days. In addition to adhering to a 30-day timeline, the fees for copies of records must be reasonable and feasible.  The acceptable fee for providing copies of documents is limited to the cost of labor for copying, supplies, postage, and any provided summary. Alternatively, your practice can charge a flat fee of not more than $6.50 instead of calculating these specific costs.   Keeping Your Practice Compliant (And Your Patients Happy) While following the Right of Access might seem straightforward, it’s one of the most common HIPAA violations practices make. There have been 50+ HIPAA Right of Access enforcement actions levied by the OCR.  With the right compliance program, you can ensure that your staff is aware of all requirements when handling patient requests. Clear policies and engaging training help you respond correctly, on time, and with confidence. Ready to ensure your practice is HIPAA compliant? Schedule a consultation with one of our compliance experts today.