Author: Suze Shaffer

Suze Shaffer is the owner and president of Aris Medical Solutions. She specializes in HIPAA compliance, risk management, and cyber security. She believes that by educating her clients in understanding why and what needs to be done to protect their practice they have a better outcome. Suze has been instrumental in helping clients nationwide with risk management, implementing privacy and security rule policies and procedures, and ultimately protecting patient data. She includes state and federal regulatory requirements to ensure clients are protected in all areas. She has spoken at numerous conferences and functions. She continues to educate organizations how to minimize the risks of data breaches. HIPAA compliance is not an option, it is mandatory for every organization that comes in contact with protected health information to have reasonable and appropriate security measures in place. Unfortunately, most organizations don’t realize they are not compliant until they suffer a data breach or they are faced with an audit or investigation. Did you know that the Office for Civil Rights (OCR) is the agency that investigates data breaches? Have you seen the heavy fines that have been imposed for non-compliance? All 50 states now have their own set of privacy laws and the State's Attorney General may also investigate privacy violations!

Vision Upright MRI fined $25K

Suze Shaffer May 15, 2025December 3, 2025

OCR Settlement with Vision Upright MRI: The Risk of Unsecured PACS Servers

The U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR), has reached a settlement with Vision Upright MRI LLC (VUM) after finding that the medical imaging provider exposed patient information online through an unsecured Picture Archiving and Communication System (PACS) server.

This case serves as another reminder that failing to secure medical imaging systems or perform a HIPAA compliant risk analysis can result in costly investigations, corrective action plans, and long-term monitoring by federal regulators.

How the Breach Happened

VUM operated a PACS server used to store and share diagnostic images such as MRIs, CT scans, and X-rays. OCR received reports that this server allowed public access to patients’ protected health information (PHI), including images, metadata, and identifying details.

On December 1, 2020, OCR notified VUM of a formal investigation into potential violations of the HIPAA Privacy, Security, and Breach Notification Rules. The inquiry focused on whether VUM had conducted proper risk assessments, secured its systems, and met notification deadlines required after discovering a breach.

OCR’s Findings

OCR determined that Vision Upright MRI:

Failed to conduct a HIPAA risk analysis — VUM had never performed an accurate and thorough assessment of potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information (ePHI), violating 45 C.F.R. § 164.308(a)(1)(ii)(A).
Failed to issue timely breach notifications — The organization did not notify affected individuals within 60 days of discovering the exposure, violating 45 C.F.R. § 164.404(a).

These lapses demonstrated that VUM lacked essential safeguards and incident-response procedures required under the HIPAA Security Rule.

Settlement Terms and Corrective Actions

As part of the settlement, VUM agreed to pay the Resolution Amount and implement a comprehensive Corrective Action Plan (CAP) overseen by OCR. The CAP requires the practice to:

Conduct a full organization-wide risk analysis, including vulnerability scans and penetration testing.
Develop a risk management plan to mitigate identified security gaps.
Update and distribute HIPAA Privacy, Security, and Breach Notification policies to all workforce members.
Provide annual HIPAA training for all staff with access to ePHI.
Investigate and report workforce noncompliance events on a quarterly basis.
Submit annual compliance reports to OCR and retain related documentation for six years.

This agreement is binding on VUM and its successors, emphasizing OCR’s expectation that covered entities maintain compliance over time—not just during the settlement period.

Lessons for Healthcare Providers and Business Associates

The VUM case highlights several key takeaways for any healthcare organization that handles PHI:

Unsecured PACS servers are a known risk.
Imaging systems frequently store and transmit PHI yet are often overlooked in IT risk analyses. Ensure every device and data repository is included in your risk inventory and tested for vulnerabilities.
Risk analysis is not optional.
HIPAA requires ongoing, accurate, and thorough assessments. This is not a one-time checkbox. Document each risk analysis, update it annually, and link findings directly to your risk-management plan.
Breach notifications must be timely.
Delays beyond 60 days can lead to enforcement actions. Have an incident-response plan ready so you can notify affected individuals and OCR within the required window.
Policies and training are the front line of compliance.
Workforce awareness is critical. Staff who access PHI must understand how to handle data securely and report potential issues immediately.
OCR oversight can last years.
Corrective Action Plans often require multi-year reporting and documentation retention. Establishing compliance habits early reduces disruption and risk later.

Summary

This settlement underscores a critical lesson: A thorough, documented risk analysis, an active risk management plan, and appropriate policies and procedures are essential in preventing data breaches. This process is long and grueling and could have easily been avoided.

HIPAA Keeper™ by Aris Medical Solutions simplifies compliance with:

Built-in risk analysis and management plans
Customizable policies and procedures
Workforce training tracking and certificates
Secure Breach Notification and Incident Response forms

Stay ahead of OCR investigations—protect your patients, your reputation, and your practice.

Don’t leave patient data exposed.

Schedule your HIPAA Risk Analysis with Aris Medical Solutions today.

Montefiore Medical Center fined $4.75M for Malicious Insider

Suze Shaffer February 6, 2024November 6, 2025

The U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR) announced a $4.75 million settlement with Montefiore Medical Center, a New York City hospital system. The settlement resolves multiple potential HIPAA Security Rule violations.

OCR enforces HIPAA’s Privacy, Security, and Breach Notification Rules. HIPAA requires health care providers, insurers, and other entities to protect the privacy and security of patient information.

Montefiore failed to safeguard its systems. An employee stole and sold the protected health information (PHI) of 12,517 patients over six months. Montefiore reported the breach after the NYPD uncovered the theft in 2015.

OCR’s investigation found Montefiore failed to:

Analyze and identify risks to PHI.
Monitor activity on its information systems.
Implement effective policies and procedures.

Because of these failures, Montefiore did not prevent or detect the attack until years later.

Settlement Terms

Montefiore must pay $4.75 million and follow a Corrective Action Plan (CAP). The CAP requires Montefiore to:

Conduct a complete risk analysis.
Develop and implement a risk management plan.
Install monitoring systems to record and review PHI activity.
Review and update HIPAA policies and procedures.
Train staff on HIPAA requirements.

OCR will monitor Montefiore for two years.

Key Quotes

OCR Director Melanie Fontes Rainer said:
“Cyber-attacks from malicious insiders are not uncommon. The risks to patient information cannot be ignored. Health care systems must follow the law and act quickly to protect records.”

HHS Deputy Secretary Andrea Palm added:
“Patients must trust providers to protect their records. Our priority remains safeguarding patients and ensuring providers implement strong security policies.”

OCR reported that 134 million people were affected by large breaches in 2023, compared to 55 million in 2022. OCR urges health care providers, health plans, and business associates to:

Conduct regular risk analyses.
Monitor information system activity.
Use multi-factor authentication.
Encrypt PHI.
Train staff frequently.
Update policies based on lessons learned from incidents.

At Aris Medical Solutions, our HIPAA Keeper™ platform helps healthcare providers simplify compliance by maintaining up-to-date policies, procedures, and workforce training to meet every aspect of the HIPAA Privacy and Security Rules.

Don’t risk costly penalties. Ensure your Compliance Officer understands their responsibility.

Schedule your HIPAA compliance review today and protect your organization from the next enforcement headline.

Patient Right of Access delays cost Optum Medical Care $160K

Suze Shaffer November 15, 2023November 12, 2025

Optum Medical Care (formerly known as Riverside Medical Group and Riverside Pediatric Group) is a large multi-specialty physician group serving patients throughout New Jersey and Southern Connecticut. Optum has agreed to pay $160,000 and implement a Corrective Action Plan (CAP) to resolve potential violations of the HIPAA Privacy Rule’s Right of Access provision.

This case marks OCR’s 46th Right of Access enforcement action, reinforcing that timely access to medical records is a fundamental patient right under HIPAA.

History

In the Fall of 2021, OCR received six complaints alleging that Optum Medical Care failed to provide patients or parents of minor patients with copies of their requested medical records. The investigation revealed delays ranging from 84 to 231 days, which are well beyond the HIPAA requirement to provide access within 30 calendar days of a valid request.

OCR began its investigation in February 2022 and determined that Optum’s failure to respond within the legally required timeframe constituted a potential violation of the HIPAA Right of Access Rule.

Settlement Terms

Under the Resolution Agreement, Optum Medical Care will:

Pay $160,000 to the U.S. Department of Health and Human Services.
Implement a Corrective Action Plan (CAP) monitored by OCR for one year.
Revise and update policies and procedures to ensure timely responses to access requests.
Train workforce members on the Right of Access requirements under HIPAA.
Report to OCR on all medical record access requests received and their fulfillment status.

OCR’s Message to Providers

OCR Director Melanie Fontes Rainer emphasized the importance of prioritizing patient access, stating:

“Health care providers must make responding to parents’ or patients’ requests for access to their medical records in a timely manner a priority. Access to medical records is a fundamental right under HIPAA… providers must proactively respond to record requests and ensure timely access.”

Rainer added that timely access empowers patients and families to make informed decisions and improve their health outcomes—reinforcing that patient rights are central to HIPAA’s mission.

What the HIPAA Right of Access Rule Requires

Under the HIPAA Privacy Rule, individuals (or their personal representatives) have the right to access, inspect, or receive copies of their health information maintained by a covered entity. Providers must:

Respond to access requests within 30 calendar days of receipt (may be reduced to 15 days).
Provide access in the format requested, if readily producible.
Charge only a reasonable, cost-based fee for copying, mailing, or preparing records.
Document and justify any extensions (up to an additional 30 days) with written notice to the requester.

Key Lessons for Healthcare Providers

This case underscores that even large, established medical groups are not exempt from enforcement. To stay compliant and avoid costly penalties, healthcare providers should:

Review and update Right of Access policies and procedures.
Maintain a tracking system for record requests and response deadlines.
Ensure all staff are trained to recognize and properly handle patient record requests.
Conduct periodic audits to verify timely responses.
Document all communications related to record requests.

HIPAA compliance is not just about data security; it’s about respecting patients’ rights. Failing to provide timely access to medical records not only violates the law but also erodes patient trust.

Don’t risk costly penalties. Ensure your team knows the rules and your policies support timely patient access.

Schedule your HIPAA compliance review today and protect your organization from the next enforcement headline.

Green Ridge Behavioral Health is Second Ransomware Settlement

Suze Shaffer October 30, 2023November 6, 2025

The U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR) announced a settlement with Green Ridge Behavioral Health, LLC, a Maryland psychiatric practice. The case involved a ransomware attack that compromised the protected health information of more than 14,000 patients.

Ransomware locks users out of their data until a hacker receives payment. OCR enforces HIPAA’s Privacy, Security, and Breach Notification Rules to protect patient information. This marks OCR’s second ransomware-related settlement.

OCR Director Melanie Fontes Rainer said:
“Ransomware is now one of the most common cyber-attacks. Patients suffer when they cannot access their medical records. Providers must take steps to prevent these attacks and protect patient data.”

The Breach

In February 2019, Green Ridge reported to OCR that ransomware encrypted its servers, company files, and all patient electronic health records. OCR’s investigation found multiple HIPAA Security Rule failures, including:

No complete risk analysis of electronic PHI.
No effective security measures to reduce risks.
No sufficient monitoring of system activity.

Settlement Terms

Green Ridge agreed to pay $40,000 and implement a Corrective Action Plan (CAP) monitored by OCR for three years. The CAP requires Green Ridge to:

Conduct a full risk analysis.
Create a risk management plan.
Update policies and procedures.
Train its workforce on HIPAA.
Audit third-party vendors and ensure business associate agreements.
Report workforce HIPAA violations to OCR.

Recommendations

Ransomware and hacking are now the top cyber threats in healthcare. Large breaches have increased 256% in the last five years. Ransomware rose 264% during the same period. In 2023, hacking caused 79% of large breaches, affecting over 134 million people—a 141% increase from 2022.

OCR recommends medical providers and business associates:

Regularly perform risk analysis and risk management.
Monitor and audit system activity.
Use multi-factor authentication and encryption.
Ensure strong vendor agreements.
Provide frequent, role-specific workforce training.
Apply lessons from past incidents.

Don’t risk costly penalties. Schedule your HIPAA compliance review today and protect your organization from the next enforcement headline.