HIPAA Enforcement Actions Against Medical Billing Vendors and Practices

In 2019, Solara Medical Supplies mailed breach notification letters to the wrong addresses, and this compounded a phishing attack that had already compromised more than 114,000 patient records. That compounding error, not the phishing attack alone, is what helped produce a $3 million settlement announced in January 2025. This piece traces that pattern: HIPAA enforcement against billing vendors and practices keeps landing on the same missing document, the same unmonitored access list, the same overdue notification, case after case. Understanding that pattern is what tells a practice where its actual exposure sits and what it needs to demand from every vendor touching patient data.

Why billing vendors and practices keep failing the same HIPAA test

Solara's $3 million penalty rested on three findings: an inadequate risk analysis, insufficient security measures, and late breach notification. The same triad of failures recurs across enforcement action after enforcement action, regardless of the specifics of any individual 2025 or 2026 case. Federal regulators announced more than 20 HIPAA settlements and civil monetary penalties across 2025 and 2026, and the Office for Civil Rights closed 21 settlements in 2025 alone, which is the second-highest annual total on record. Nearly all of them share one root finding: the organization could not produce evidence that it had ever conducted an accurate, thorough risk analysis of its electronic protected health information.

The breach itself is rarely what OCR penalizes most heavily. A phishing attack, a stolen laptop, a ransomware intrusion, these are the events that trigger an investigation, but the missing risk analysis is what turns that event into a six-figure settlement and a multi-year corrective action plan. An organization that can show it identified its risks, documented them, and acted on what it found faces a different regulatory conversation than one that never looked.

This problem is not confined to hospital systems or national billing clearinghouses. Settlements in 2025 and 2026 targeted hospitals, business associates, retailers, accounting firms, dental software vendors, and employer-sponsored health plans. The size and sector of the organization varies. The underlying finding does not.

How OCR's enforcement machinery works and who it reaches

HIPAA enforcement runs through more than one agency. OCR leads investigations, but the Department of Justice, CMS, state attorneys general, and the FTC each hold independent authority to act, and a single incident can trigger parallel proceedings from several regulators at once. OCR investigates complaints, conducts audits, issues civil monetary penalties, and refers criminal matters to the DOJ. State attorneys general don't need to wait for OCR to finish before bringing their own case: in the Enzo Biochem matter, New York, New Jersey, and Connecticut secured a combined $4.5 million from the company in a multistate action that ran alongside federal enforcement.

The HITECH Act changed who falls inside this system. It reversed the burden of proof for covered entities and business associates alike, and it extended HIPAA's compliance requirements directly to business associates. Billing vendors, clearinghouses, and statement processors are not secondary parties shielded behind the practices that hire them. Under the Security Rule, they carry the same legal obligations as the covered entities they serve.

Penalties scale across four tiers based on culpability, with willful neglect that goes uncorrected carrying the highest per-violation maximum in the schedule. Annual caps apply per category of violation, not per incident, so if one bad practice repeats across a year of patient records, the total can climb fast. Most billing-related settlements land in Tier 1 or Tier 2, and that placement reflects something specific: OCR treats an incomplete compliance program differently from one that ignored a known risk. Documented effort to comply, even an imperfect program, moves an organization into a lower penalty tier than an organization that made no effort.

The dollar figure on a settlement rarely tells the full cost. Forensic investigation, breach notification mailings, credit monitoring for every affected patient, and legal fees typically add up to far more than the civil penalty itself. Corrective action plans then impose years of federal monitoring, regular reporting, audits, and ongoing OCR oversight, a burden that can exceed the original fine in sheer operational disruption. None of this is reserved for large systems. The enforcement docket includes small and mid-sized practices, and when a single billing vendor serving dozens of covered entities fails, you can see how fast that failure spreads across its entire client base. That contagion dynamic is where the specific vendor cases become instructive.

Vendor Liability in the Comstar, MMG Fusion, and Assured Imaging Cases

When a billing vendor fails its HIPAA obligations, every covered entity it serves inherits that exposure. OCR's recent enforcement record shows that vendors face direct liability as business associates. That liability does not pass back to the covered entity through an indemnification clause and disappear.

MMG Fusion, a healthcare software vendor, settled in March 2026 for a modest sum, just $10,000, despite a breach that impermissibly disclosed the protected health information of approximately 15 million individuals. OCR stated that it considered MMG's financial condition in reaching that number. The gap between the scale of that breach and the size of the settlement is the most instructive figure in this entire enforcement record. It shows that the dollar amount OCR assesses is driven far more by an organization's ability to demonstrate responsible action, and by what it can actually pay, than by the raw number of records exposed.

The Comstar case shows how a single business associate breach moves. It doesn't stay contained within that vendor's own systems. That failure appears simultaneously in the breach reports and compliance obligations of every covered entity on that vendor's client list, each one now facing its own notification duties and its own OCR inquiry over a failure it didn't directly cause.

Heritage Valley Health System's settlement adds a different angle to that same story. Heritage Valley's network was compromised through its business associate, Nuance Communications, during the global NotPetya malware outbreak, which entered through a trusted VPN connection between the two organizations. Heritage Valley was not the attacker's target. But its lack of a documented risk analysis and its absence of an emergency contingency plan turned its vendor's breach into its own compliance failure.

Some practices assume that once they sign a business associate agreement, liability shifts entirely to the vendor and their own exposure ends. The enforcement record says otherwise: OCR investigates both parties to a BAA relationship. A BAA is a contractual requirement, not a shield. Covered entities are expected to vet their business associates and monitor them on an ongoing basis, not simply collect a signature and move on.

The three Security Rule failures that appear in nearly every recent settlement

The cases above point to three specific, recurring gaps in the Security Rule that appear across the 2025 and 2026 enforcement record with enough consistency to function as a practical audit checklist for any practice or vendor handling patient billing data.

The first failure is a missing or stale risk analysis. The Security Rule requires a documented risk analysis under 45 C.F.R. §164.308(a)(1)(ii)(A), and that is the exact provision cited in nearly every recent settlement. A risk analysis completed years ago, before a new billing vendor came on board, before an EHR migration, or before a practice management system upgrade, does not satisfy this requirement going forward. OCR treats each of those events as a trigger for a fresh assessment. OCR launched a formal Risk Analysis Initiative in late 2024, and by mid-to-late 2025 it had closed roughly a dozen cases under that initiative, reaching 13 to 14 total by 2026, every one of them built around this same finding.

The second failure is a missing or outdated business associate agreement. Any vendor touching protected health information on a practice's behalf, billing companies, clearinghouses, statement vendors, cloud storage providers, needs a signed BAA in place before any data changes hands. The Comstar case shows how this plays out in practice: the BAA relationship created obligations running in both directions, and the vendor's failure to conduct its own risk analysis violated those obligations directly. A signature on a BAA means little without actual vetting of what the vendor does with the data afterward. OCR's proposed updates to the Security Rule would require annual verification of a business associate's security measures, and practices not already doing this will need to build that process now.

The third failure is access control that isn't role-based. Billing staff need financial and demographic information to do their jobs, not full clinical charts, and the Privacy Rule's minimum-necessary standard draws that boundary explicitly. Ambry Genetics Corporation's 2026 settlement cited a failure to terminate electronic access upon employee termination and a failure to assign unique usernames to system users, an access hygiene gap that compounds quietly over time and stays invisible if you don't run active audit logging. Warby Parker's penalty included a finding that it failed to implement procedures for regularly reviewing records of information system activity, the same category of monitoring gap that made BayCare's insider incident possible when a former employee's credentials were never deactivated.

Late breach notification works as a fourth, stackable category, not a standalone root cause. Assured Imaging's settlement shows how this works: missing the 60-day notification window adds to a penalty even when the underlying breach and risk analysis failures are otherwise addressed on their own terms.

The Right of Access enforcement record and billing departments

OCR's Right of Access initiative targets a different kind of failure, and it lands squarely on billing departments because of what those departments do every day. Billing staff routinely field patient requests for account statements, explanation of benefits documents, and supporting records, so if they delay or deny one of those requests, it carries the same penalty exposure as a data breach.

The initiative has produced more than 50 enforcement actions. Concentra, Inc. settled for $112,500 in 2025 after a patient made six separate requests for records beginning in February 2018 and did not receive them until March 2019, over a year later. The Right of Access rule requires covered entities to provide access in the form and format the patient requests, paper or electronic, within defined timeframes. A billing department that routes these requests to an unowned inbox, or treats them as lower priority than claim submissions, is building direct regulatory exposure into its daily workflow.

If a practice outsources billing to an outside vendor, it needs to confirm that the vendor's own workflows include a documented process for handling patient access requests. That confirmation belongs in the BAA itself, and it's exactly the kind of thing vendor vetting is supposed to catch before a contract is signed. The fix here is procedural rather than technical: a named owner for access requests, a documented response timeline, and a log tracking requests and responses is the baseline OCR expects to find.

OCR's serialized ransomware enforcement program and the risk calculus for billing vendors

OCR runs ransomware enforcement as a deliberate, numbered series, and that structure changes what exposure looks like for any billing vendor processing claims on networked servers. The January 2025 resolution agreements with VPN Solutions and Elgon Information Systems were titled, respectively, as the "9th" and "8th" ransomware settlements in that series, confirming this is a structured, ongoing initiative.

Of the eighteen 2025 resolution agreements posted on the HHS index, at least nine specifically cite ransomware in the press-release title. That concentration lines up with the broader breach data: more than 80% of reported 2025 HIPAA breaches were hacking or IT incidents driven by cyberattacks.

A billing vendor's exposure to this program is amplified by scale. A single compromise at one vendor doesn't just generate one breach report. It produces simultaneous reports across every covered entity in that vendor's client base, and each one of those reports triggers its own OCR inquiry, running in parallel, against a practice that may have had no direct role in the incident.