Skip to main content

Nixon Peabody LLP

  • People
  • Capabilities
  • Insights
  • About
Trending Topics
    • People
    • Capabilities
    • Insights
    • About
    • Locations
    • Events
    • Careers
    • Alumni
    Practices

    View All

    • Affordable Housing
    • Community Development Finance
    • Corporate & Finance
    • Cybersecurity & Privacy
    • Entertainment & Media
    • Environmental
    • Franchising & Distribution
    • Government Investigations & White Collar Defense
    • Healthcare
    • Intellectual Property
    • International Services
    • Labor, Employment, and Benefits
    • Litigation
    • Private Wealth & Advisory
    • Project Finance
    • Public Finance
    • Real Estate
    • Regulatory & Government Relations
    Industries

    View All

    • Aviation
    • Cannabis
    • Consumer
    • Energy
    • Financial Services
    • Healthcare
    • Higher Education
    • Infrastructure
    • Manufacturing
    • Nonprofit Organizations
    • Real Estate
    • Sports & Stadiums
    • Technology
    Value-Added Services

    View All

    • Alternative Fee Arrangements

      Developing innovative pricing structures and alternative fee agreement models that deliver additional value for our clients.

    • Continuing Education

      Advancing professional knowledge and offering credits for attorneys, staff and other professionals.

    • Crisis Advisory

      Helping clients respond correctly when a crisis occurs.

    • DEI Strategic Services

      Providing our clients with legal, strategic, and practical advice to make transformational changes in their organizations.

    • eDiscovery

      Leveraging law and technology to deliver sound solutions.

    • Environmental, Social, and Governance (ESG)

      We help clients create positive return on investments in people, products, and the planet.

    • Global Services

      Delivering seamless service through partnerships across the globe.

    • Innovation

      Leveraging leading-edge technology to guide change and create seamless, collaborative experiences for clients and attorneys.

    • IPED

      Industry-leading conferences focused on affordable housing, tax credits, and more.

    • Legal Project Management

      Providing actionable information to support strategic decision-making.

    • Legally Green

      Teaming with clients to advance sustainable projects, mitigate the effects of climate change, and protect our planet.

    • Nixon Peabody Trust Company

      Offering a range of investment management and fiduciary services.

    • NP Capital Connector

      Bringing together companies and investors for tomorrow’s new deals.

    • NP Second Opinion

      Offering fresh insights on cases that are delayed, over budget, or off-target from the desired resolution.

    • NP Trial

      Courtroom-ready lawyers who can resolve disputes early on clients’ terms or prevail at trial before a judge or jury.

    • Social Impact

      Creating positive impact in our communities through increasing equity, access, and opportunity.

    • Women in Dealmaking

      We provide strategic counsel on complex corporate transactions and unite dynamic women in the dealmaking arena.

    1. Home
    2. Insights
    3. Articles
    4. OCR publishes fifth enforcement action under its Risk Analysis Initiative

      Articles

    Article

    OCR publishes fifth enforcement action under its Risk Analysis Initiative

    April 9, 2025

    LinkedInX (Twitter)EmailCopy URL

    By Valerie Montague, Meredith LaMaster and Grace Connelly

    OCR and Health Fitness Corporation settle for $227,816 in late 2024 after breach notifications in 2018 and 2019 and a subsequent investigation.

    On March 21, 2025, the Department of Health and Human Services (HHS) Office for Civil Rights (OCR) announced a $227,816 settlement with Health Fitness Corporation (Health Fitness), an Illinois company and HIPAA business associate providing wellness plans to clients nationwide. OCR and Health Fitness entered into a resolution agreement in late December 2024, prior to the change in the presidential administration.

    Emphasis on risk analysis

    In 2018, Health Fitness discovered that a software misconfiguration had caused electronic protected health information (ePHI) stored on its server to become discoverable on the internet and exposed to automated search devices (web crawlers), dating back to 2015. After Health Fitness provided breach notification to OCR in 2018 on behalf of multiple covered entities as their business associate, OCR conducted an investigation and determined that Health Fitness had failed to conduct an accurate and thorough assessment of potential risks and vulnerabilities to the confidentiality, integrity, and availability of its ePHI.

    This marks OCR’s fifth enforcement action under its Risk Analysis Initiative, an initiative created to emphasize the importance of conducting risk analyses and to increase the number of completed investigations involving potential violations of the HIPAA Security Rule. Because OCR and Health Fitness settled the investigation in late 2024, it remains unclear whether the Risk Analysis Initiative will continue to be an area of focus for the current administration.

    Health Fitness’s corrective action plan

    In addition to the financial settlement, Health Fitness also agreed to implement a two (2)-year corrective action plan (CAP), which will be monitored by OCR. Under the CAP, Health Fitness will take steps to safeguard its ePHI, including by:

    • Evaluating and updating its risk analysis annually;
    • Developing a risk management plan to account for and mitigate security risks and vulnerabilities identified in its risk analysis;
    • Implementing a process for evaluating changes to its environment and operations that affect the security of ePHI; and
    • Developing, maintaining, and updating, as necessary, its policies and procedures to ensure compliance with HIPAA.

    Takeaways for HIPAA-regulated entities

    The Health Fitness settlement serves as an important reminder to HIPAA-regulated entities to implement security processes and controls to ensure that the entity safeguards the ePHI it stores, accesses, and discloses.

    In addition, it serves as another example of how the HIPAA breach resolution process may take time. Health Fitness reported the breaches to OCR in 2018 and 2019 and did not enter into a settlement with OCR until 2024, approximately six (6) years later. In the event that a HIPAA-regulated entity must provide breach notification to OCR, it should keep in mind that OCR compliance investigations and, as applicable, related resolution processes, often take time and may result in a multi-year process.

    Though OCR HIPAA enforcement priorities under the new administration are yet to be seen, the Health Fitness settlement emphasizes the need for HIPAA-regulated entities to conduct accurate and thorough risk analyses to maintain a robust HIPAA compliance program.

    New Administration HubOCR Action

    Practices

    HealthcareHealthcare Regulatory & ComplianceHealth Information - Privacy, Security & Data Sharing

    Industries

    Healthcare

    Insights And Happenings

    • Alert

      CMS proposes updates to the Transforming Episode Accountability Model

      May 2, 2025
    • Article

      New administration continues pace of OCR’s HIPAA enforcement

      April 25, 2025
    • Article

      OCR announces first HIPAA settlement under the new administration

      April 21, 2025
    The foregoing has been prepared for the general information of clients and friends of the firm. It is not meant to provide legal advice with respect to any specific matter and should not be acted upon without professional counsel. If you have any questions or require any further information regarding these or other related matters, please contact your regular Nixon Peabody LLP representative. This material may be considered advertising under certain rules of professional conduct.

    Subscribe to stay informed of the latest legal news, alerts, and business trends.Subscribe

    • People
    • Capabilities
    • Insights
    • About
    • Locations
    • Events
    • Careers
    • Alumni
    • Cookie Preferences
    • Privacy Policy
    • Terms of Use
    • Accessibility Statement
    • Statement of Client Rights
    • Purchase Order Terms & Conditions
    • Nixon Peabody International LLC
    • PAL
    © 2025 Nixon Peabody. All rights reserved