March Recap: HIPAA Was Made for This

April 2, 2020

We know times are a little turbulent right now. Way of life in America looks a lot different at the end of March than it did at the beginning of the month. Most of us are now working from home, cleaning and washing our hands more than ever before and worrying about when stores will finally restock on toilet paper. And like many of us, healthcare professionals across the United States have been following the growing number of COVID-19 cases with great concern. It’s a looming reality that some have even been in contact with patients who have tested positive for the Coronavirus. However, when it comes to sharing sensitive medical information, there are many misconceptions that paint HIPAA laws in such a way that make it appear as if it is an obstacle rather than what HIPAA is intended to promote – which is the allowance of protected health information to be shared securely, efficiently and with the right people. What so many don’t understand is that HIPAA rules and regulations identify the right ways and the wrong ways of making sensitive information accessible – especially in times of crisis. 

Even during a public health emergency, HIPAA still applies – in fact, HIPAA law has included specific ways where PHI can be shared in a health emergency pretty much since its inception. These regulations include an expanded ability to share PHI with those directly working on the public health threat, but still prohibit disclosures that are not secure such as those to the public at large. 

A great example of this is the recent news headlines featuring the names of well-known public figures testing positive. These individuals chose to share their diagnosis and spread awareness, but if diagnoses are made public without the required patient consent – like what happened to a Detroit Pistons player whose positive test made headlines before he had a chance to tell his own mother – HIPAA laws have been violated. Media leaks are common, but sensitive health information should be handled with extreme care.

HIPAA was built to mitigate public risk during a health emergency while still maintaining the privacy that all individuals deserve. Despite what you may have heard, HIPAA doesn’t make it impossible for you to know whether you’ve been in contact with an infected person – it just regulates the type of information that is shared. With misinformation and public anxiety swirling, read up on our simplified guidance on handling HIPAA during a public health emergency to learn more. The OCR has also released several bulletins serving as both updates and reminders on HIPAA regulations to best meet the current needs of patient privacy. 

To make things a little easier, here’s a quick summary on recent bulletins regarding COVID-19:

  • March 28 Bulletin: In their most recent bulletin, the OCR reminded providers that at all times including during the current outbreak it is unlawful to discriminate when making decisions about patient treatment. The bulletin included a statement by OCR Director Roger Severino:  “HHS is committed to leaving no one behind during an emergency, and helping health care providers meet that goal.” 
  • March 17 & 20 Bulletins: Skype is for more than just keeping in touch with friends and hosting virtual happy hours! To encourage the use of telehealth services to best protect patients and practices from the risk of contracting or spreading COVID-19, the OCR released a Notice of Enforcement Discretion which allows limited non-HIPAA compliant applications to be used for telehealth services only during the current crisis. A second bulletin offered additional information on FAQs relating to the enforcement discretion. Read more in our article discussing these changes to HIPAA and Telehealth Services. 
  • March 18 Bulletin: Unfortunately, COVID-19 isn’t the only virus to be worried about these days. In response to recent cyberattacks related to the current public health emergency, the OCR and CISA issued a statement urging not only health care practices but all businesses to exercise increased precaution around websites or links related to COVID-19. Read more in our article about how public health emergencies bring an increased risk of cyber attacks.

With the constant news stories and anxiety around COVID-19, we know it can be tough to keep up with HIPAA on top of everything else. Yet as with any health-related event, HIPAA is key to protecting patients’ privacy and preventing other threats to patient data & security. In short, HIPAA is more important now than ever.

RECENT POSTS

Related posts

Dental Practice HIPAA Settlement
Abyde News, Fines, HIPAA

What Every Dental Practice Can Learn From the $140K Shen Smiles Settlement

October 9, 2026 No comments yet

October 9, 2026 The latest HIPAA settlement doesn’t involve a hospital system or a massive ransomware attack. It involves a practice that probably looks a lot like yours. Shen Smiles is a solo dental practice in Drums, Pennsylvania. It started with a former patient’s complaint about getting their health records. It led to a broader OCR investigation and a $140,000 settlement. The lesson? Every HIPAA-regulated organization, big or small, can face enforcement.   What happened? Under federal law, patients must be given access to their records within 30 days, with one possible 30-day extension if the patient is notified in writing within the first 30 days. In April 2020, a former patient’s attorney filed a complaint with the Office for Civil Rights (OCR). The complaint alleged that the patient had requested their records multiple times without receiving access. The public documents don’t say when the first request was made. OCR’s investigation went beyond the original complaint. According to the resolution agreement, OCR found that patient records weren’t properly maintained and that staff hadn’t received formal HIPAA Privacy Rule training. OCR also said the practice couldn’t produce evidence that it had HIPAA policies and procedures in place, including for patient access requests, or that it had reasonably safeguarded patient information. During the investigation, the practice stated that it couldn’t provide the records because a workforce member had stolen them. The public documents don’t address whether a breach assessment was done. As a general rule, though, HIPAA presumes that an impermissible acquisition, access, use, or disclosure of unsecured patient information is a breach. A breach can require notifying HHS and affected patients, including steps patients can take to protect themselves. These are baseline requirements every covered entity is expected to have in place. Policies and training give a team a HIPAA playbook. Without one, staff at any practice may not know what to do when a patient asks for records or records go missing. OCR proposed a $140,000 civil money penalty in July 2024. Shen Smiles requested a hearing before an administrative law judge, but the two sides reached a resolution agreement in August 2026, before the hearing took place. Under the agreement, the practice agreed to pay $140,000. The agreement is not an admission of liability.   The Takeaway for Practices Patient access has been an OCR priority for years through its HIPAA Right of Access Initiative, and this case marks its 56th Right of Access enforcement action. It also took more than six years from complaint to resolution. As this case shows, a single complaint can lead to a broader look at your compliance program. Now is the time to ask: Do we have written HIPAA policies our team can find? Do we have a process to answer every record request within 30 days? Can we prove every team member has completed HIPAA training? If any of those gave you pause, now’s the time to fix it, before OCR comes asking. Looking for the first step? Meet with one of our compliance experts to see where you currently stand. 

Ambry Phishing Settlement
Abyde News, Fines, HIPAA

$700K HIPAA Settlement: What the Ambry Genetics Phishing Breach Teaches Every Practice

September 21, 2026 No comments yet

September 21, 2026   The HHS Office for Civil Rights (OCR) has announced its biggest HIPAA settlement of the year, reaching nearly a million dollars.  Ambry, a genetic testing and clinical genomics provider based in Aliso Viejo, California is at the center of this enforcement. A settlement was reached over a 2020 phishing attack that exposed the Protected Health Information (PHI) of more than 225,000 individuals. This settlement is a clear reminder that even large organizations trip up on HIPAA requirements.    What happened In January 2020, an employee email account at Ambry was compromised through a phishing attack.  The breach potentially exposed a wide range of PHI, including names, addresses, dates of birth, Social Security Numbers, financial details, and more. Ambry reported the breach to OCR in March 2020, which kicked off the investigation.    Where OCR found gaps OCR’s investigation identified several HIPAA Security Rule gaps, including: No accurate, thorough risk analysis of risks and vulnerabilities to ePHI No process for cutting off access to ePHI when an employee left or no longer needed access No unique user IDs for tracking who was accessing ePHI systems These are baseline HIPAA requirements that every Covered Entity and Business Associate is expected to have in place.   The settlement terms Ambry paid $700,000 and agreed to a two-year corrective action plan, under which it must: Complete a thorough risk analysis of ePHI confidentiality, integrity, and availability Build and execute a risk management plan addressing what that analysis turns up Review and update Security Rule policies and procedures as needed Implement unique user identification across all ePHI systems Train the whole workforce on those updated policies The takeaway for practices When 90% of healthcare hacks start with a successful phishing attempt, it’s key your team is aware of the role they play to keep data safe. Every practice should ask; Do we know exactly where our ePHI lives and how it moves through our systems? Do we have a current, documented risk analysis? Would we catch it fast if a former employee’s access wasn’t revoked? Looking for the first step of addressing these gaps? Meet with one of our compliance experts to see where you currently stand. 

Azul Vision Right of Access
Abyde News, Fines, HIPAA

Right of Access Enforcement Hits Eye Care: Inside the Azul Vision Settlement

September 1, 2026 No comments yet

September 1, 2026   The Office for Civil Rights (OCR) announced its 55th settlement under the HIPAA Right of Access Initiative, and this one is a good reminder that “we’ll get to it” is an easy shortcut to a massive financial penalty.   What happened Azul Vision, Inc., a California optometry enterprise healthcare provider, took nearly two years to provide a patient her healthcare records failed to give a patient timely access to her health records. She requested her records in January 2023. She didn’t actually receive them until January 2025, or two years later, and only after OCR opened an investigation following her complaint in April 2023.   The importance of Right of Access The HIPAA Privacy Rule’s Right of Access is straightforward: patients are entitled to their healthcare records within 30 days of a request, with one possible 30-day extension if needed.    The cost Azul Vision agreed to a two-year, OCR-monitored corrective action plan and paid $50,000. The corrective action plan requires the practice to: Review and revise its written policies and procedures for Privacy Rule compliance.  Regularly report to HHS a log of every PHI access request it receives, including when it came in and when it was resolved, Train all workforce members on right of access requirements and the practice’s own procedures.   Practical takeaways Have a documented, assigned process for access requests: not an informal “someone will handle it” arrangement. Track every request against the 30-day (or extended 60-day) clock: If nothing is timestamping requests, nothing is catching the ones that slip. Train staff specifically on right of access: this is a distinct Privacy Rule obligation from general HIPAA awareness, and it’s clearly one OCR is actively enforcing.   The bottom line A single records request that went unanswered turned into a $50,000 penalty, two years of federal monitoring, and a detrimental hit to the organization’s reputation. That’s a steep price for what really comes down to a missing process. If your team can’t answer “what happens the moment a patient asks for their records?” right now, that’s the gap to close before your practice ends up as OCR’s next enforcement case. Want a streamlined way to close your compliance gaps? Meet with an Abyde expert today!