HHS Office for Civil Rights Settles HIPAA Phishing Cybersecurity Investigation with Solara Medical Supplies, LLC for $3,000,000

HHS OCR announced a $3,000,000 settlement with Solara Medical Supplies following a 2019 phishing incident that allowed unauthorized access to eight employee email accounts and breached the ePHI of 114,007 individuals, with an additional error sending 1,531 breach notices to wrong addresses; OCR found failures in risk analysis, security controls, and timely notification, and imposed a two-year corrective action plan including comprehensive risk analysis, risk management, policy updates, and workforce training.