On October 8, 2026, the HHS Office for Civil Rights (OCR) announced that Shen Smiles, a Pennsylvania dental practice, agreed to pay $140,000 after a patient couldn't obtain her medical records. The practice told investigators that a workforce member took the records, while OCR found failures in privacy policies, breach notification procedures, and safeguards. Among recent HIPAA violation examples, this case stands out because the problem involved records access and internal processes rather than a sophisticated cyberattack.
Real enforcement cases show how compliance can fail when organizations lack basic policies, overlook employee access, or lose control of vendor-handled information. This guide to HIPAA compliance in telehealth explains the underlying requirements. The cases below examine what OCR found in actual investigations and how similar weaknesses can appear inside a digital healthcare business.
One Phishing Email, $700,000
Ambry Genetics | September 17, 2026 | $700,000 settlement
What Happened
In January 2020, a phishing attack compromised an employee's email account at Ambry Genetics, a California company providing genetic testing and clinical genomics services. The incident potentially exposed the protected health information of 225,370 individuals.
The affected information included names, contact details, certain identification and financial information, diagnoses, laboratory results, medications, and treatment information. Ambry reported the incident to OCR in March 2020, triggering an investigation into the organization's HIPAA Security Rule practices.
What OCR Found
According to the HHS enforcement announcement, OCR identified potential violations involving three fundamental requirements:
- Failure to conduct an accurate and thorough risk analysis of electronic protected health information (ePHI)
- Inadequate procedures for terminating access when workforce members leave or no longer require access
- Failure to assign unique identifiers for tracking users in systems containing ePHI
Ambry agreed to pay $700,000 and implement a corrective action plan monitored by OCR for two years.
The case demonstrates why investigating an email compromise involves more than reviewing the original phishing message. OCR also examines whether the organization had identified risks, controlled access, and maintained accountability for individual users.
What This Means for Telehealth
Telehealth businesses frequently depend on email, support accounts, and shared communication workflows. Those systems can become entry points for unauthorized access when employees handle patient information or have credentials connected to clinical platforms.
A practical review of HIPAA-compliant email should therefore extend beyond selecting an email provider. Operators also need to assess authentication, employee access, account termination procedures, and how they handle communications involving PHI.
For fast-growing brands, offboarding deserves particular attention. An employee leaving the organization should not retain access to patient information simply because an administrator forgot to deactivate an account.
A Billing Vendor's Ransomware
Comstar, LLC | May 30, 2025 | $75,000 settlement
What Happened
Comstar provided billing, collection, and related services to emergency ambulance organizations. As a business associate serving more than 70 covered entities, it handled information connected to patients receiving those services.
On March 19, 2022, attackers gained access to Comstar's systems and deployed ransomware that encrypted its servers. The incident affected approximately 585,621 individuals.
Although the ransomware attack hit a billing company rather than a healthcare provider, the consequences extended to patients whose information the vendor processed.
What OCR Found
OCR determined that Comstar had failed to conduct an accurate and thorough risk analysis addressing potential risks and vulnerabilities to ePHI.
The company agreed to pay $75,000 to resolve the investigation. The May 2025 settlement marked OCR's ninth enforcement action under its Risk Analysis Initiative and its thirteenth ransomware enforcement action.
The case appears among the enforcement matters HHS maintains in its resolution agreements and civil money penalties collection.
The finding matters because failing to conduct an adequate risk analysis is itself a compliance issue. OCR does not need to show that every possible security control was missing to identify a failure to assess the risks affecting protected information.
What This Means for Telehealth
A telehealth brand may rely on billing platforms, clinical software, pharmacies, customer relationship management systems, and other outside services. When those organizations act as business associates, their security practices affect the brand's overall data protection program.
Choosing a HIPAA-compliant CRM, for example, involves more than checking whether the vendor advertises healthcare features. The business needs to understand what information it shares with the vendor, the contractual protections that apply, and how the vendor will handle security incidents.
A vendor breach does not automatically create a HIPAA violation for the healthcare brand. However, outsourcing a function does not remove the need to evaluate vendor relationships and manage the risks associated with patient information.
Records That Took Too Long
Oregon Health & Science University | March 6, 2025 | $200,000 civil money penalty
What Happened
A personal representative requested medical records from Oregon Health & Science University (OHSU). The organization provided part of the requested information in April 2019, but it did not deliver the remaining records until August 2021.
OCR investigated the delay and concluded that OHSU had failed to provide timely access under the HIPAA Privacy Rule.
Unlike the first two cases, this enforcement action did not center on a cyberattack. The underlying issue was a failure to honor a patient's right to access health information.
What OCR Found
OCR imposed a $200,000 civil money penalty and announced it on March 6, 2025.
The agency emphasized that covered entities remain responsible for timely records access even when they contract with business associates to help process those requests.
The HIPAA Privacy Rule generally requires covered entities to respond to requests for access within 30 days, subject to a permitted extension under specified conditions. Delays can therefore become compliance problems when requests are not properly tracked, assigned, or fulfilled.
What This Means for Telehealth
Digital healthcare businesses may receive records requests through a patient portal, customer support tickets, email, or communication with a clinical partner.
Operational risk arises when no one clearly owns the request. A support team may receive it while the medical group holds the records, leaving each organization expecting the other to respond.
Telehealth operators should establish who receives requests, who verifies authorization, who retrieves the records, and how deadlines are monitored. Those responsibilities remain important even when technology makes submitting a request easier.
The Rule Without a Settlement Yet: Tracking Technologies
Some HIPAA risks are addressed through regulatory guidance rather than the enforcement cases discussed above.
OCR's guidance on online tracking technologies examines how tools such as analytics scripts and advertising pixels may collect or transmit protected health information from websites and mobile applications.
The guidance explains several important distinctions:
- Tracking technologies on authenticated webpages generally have access to PHI.
- Information collected through a regulated entity's mobile application generally is PHI.
- When tracking vendors receive PHI as business associates, appropriate business associate agreements are required.
- A tracking tool does not eliminate the regulated entity's responsibility to assess what information it discloses.
However, an important legal limitation applies.
On June 20, 2024, a federal court in Texas vacated part of OCR's guidance. The vacated portion treated the combination of an individual's IP address and a visit to an unauthenticated public webpage concerning a health condition or healthcare provider as sufficient, by itself, to trigger HIPAA obligations.
The ruling did not eliminate HIPAA obligations for tracking technologies generally. Organizations still need to examine what information their tools collect and whether particular disclosures involve PHI.
What This Means for Telehealth
A telehealth website may use marketing analytics on public pages while also offering logged-in patient accounts, intake questionnaires, and appointment workflows. Those environments do not necessarily involve the same categories of information.
Understanding the difference between ordinary identifying information and PHI helps operators evaluate whether an analytics configuration introduces unnecessary disclosure risks.
Keeping marketing tags off authenticated pages and sensitive intake workflows can reduce exposure. However, organizations should still review the full data flow rather than assume removing a single tool resolves every issue.
What the Cases Have in Common
Although the incidents involved different organizations and circumstances, the enforcement findings point to recurring weaknesses in security, governance, and patient-information processes.
| Case | Announced | Amount | Root Failure Identified by OCR |
|---|
| Shen Smiles | October 2026 | $140,000 | Missing privacy and right-of-access policies and safeguards |
| Ambry Genetics | September 2026 | $700,000 | Inadequate risk analysis, access termination, and unique user identification |
| Comstar | May 2025 | $75,000 | Failure to conduct an accurate and thorough risk analysis |
| OHSU | March 2025 | $200,000 penalty | Failure to provide timely access to medical records |
The cases illustrate different responsibilities within a telehealth organization. Security weaknesses may involve authentication and account management, while privacy violations can involve missing procedures or delays in fulfilling patient requests. A SOC 2 report may help operators evaluate certain vendor controls, but it does not replace the organization's own HIPAA obligations.
Access Controls on the Bask Platform
Two of the findings above, weak access termination and missing unique user identification, concern who can access the system and whether each user can be distinguished. Bask's security controls include two-factor authentication, administrative access control, a single place to manage user identities and connected devices, and system monitoring, logging, and alerting; the platform also maintains audit logging and SOC 2 Type II controls. Those controls apply to the platform itself. A brand's email accounts, other vendors, privacy policies, and records-request handling stay with the brand, and the platform's controls alone don't mean an organization would have avoided any of these enforcement actions.
FAQs
What Is a Real-Life Example of a HIPAA Violation?
Ambry Genetics provides a recent example. After a phishing attack compromised an employee email account and potentially exposed information belonging to 225,370 individuals, OCR identified deficiencies in risk analysis, employee access termination procedures, and unique user identification. The company settled for $700,000 in September 2026.
What Do Recent OCR Settlements Have in Common?
The cases repeatedly emphasize documented risk analysis, access management, privacy policies, and timely patient access to records. However, each investigation involves different facts, so these examples should not be interpreted as a statistical ranking of the most common HIPAA violations.
Do HIPAA Rules Apply to a Telehealth Company's Vendors?
Yes, when a vendor functions as a business associate under HIPAA. Business associates have direct obligations under applicable HIPAA provisions and can face OCR investigations and enforcement actions.
The Comstar case demonstrates that a company providing administrative healthcare services can be investigated and penalized for failures involving protected health information.
Can a Court Ruling Change HIPAA Guidance?
Yes. Courts can invalidate agency guidance or portions of it when the guidance exceeds applicable legal authority.
The June 2024 ruling involving online tracking technologies vacated a specific part of OCR's interpretation concerning IP addresses and visits to unauthenticated public webpages. Other applicable HIPAA requirements and the remaining guidance still need to be considered.
References
- U.S. Department of Health and Human Services. (2026). HHS' Office for Civil Rights settles HIPAA investigation of Ambry Genetics phishing attack affecting 225,000 individuals. https://www.hhs.gov/press-room/hhs-office-civil-rights-settles-hipaa-investigation-ambry-genetics-phishing-attack-affecting-225000-individuals.html
- U.S. Department of Health and Human Services. (n.d.). Resolution agreements and civil money penalties. https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html
- U.S. Department of Health and Human Services. (2024). Use of online tracking technologies by HIPAA covered entities and business associates. https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/hipaa-online-tracking/index.html
