HIPAA Enforcement Tracker: Every OCR Penalty and Settlement, 2016 to 2026

How has HIPAA enforcement changed?

OCR now brings more cases with smaller amounts. Between 2016 and 2019, the median verified HIPAA settlement or penalty was $1,600,000 (n=39). Between 2024 and 2026, it was $240,000 (n=37). Total dollars collected peaked in 2018 at $25,635,400, the year of the $16 million Anthem settlement, while 2025 produced the most actions on record with $8,580,316 in verified amounts.

Part of the volume increase comes from OCR initiatives that target specific obligations at scale, first patient right of access and, more recently, ransomware and Security Rule cases. These initiatives produce many smaller resolutions rather than a few large ones.

Is ransomware driving HIPAA enforcement?

Increasingly, by OCR’s own announcements. The first enforcement action with “ransomware” in its HHS title was announced on 2023-10-31. Since then, 14 actions have named ransomware. In 2025, 17 of 25 actions were announced as ransomware, hacking, phishing, or Security Rule cases.

Year-by-year summary

“Security-named” counts actions whose HHS title names ransomware, phishing, hacking, cybersecurity, malware, a malicious insider, or the Security Rule. Older HHS titles named causes less consistently, so this column is not comparable across the full period.

The ledger: every action since January 2024

Each entry links to the HHS source document. Rows with a red edge were announced as security cases.

The full ledger back to 2008 is in the downloadable dataset below.

Frequently asked questions

How many HIPAA enforcement actions were there in 2025?

25, the highest annual count on the HHS OCR resolution agreements and civil money penalties list.

What is the average HIPAA penalty?

The median verified amount for 2024 to 2026 was $240,000. Medians are more representative than averages because a few large settlements skew the mean.

What is the largest HIPAA settlement?

Anthem’s $16 million settlement in October 2018, after what HHS described as the largest health data breach in history, which exposed the electronic protected health information of almost 79 million people.

Does OCR penalize ransomware victims?

OCR has resolved 14 investigations naming ransomware since October 2023. In the three ransomware resolution documents we could read in full, OCR cited the Security Rule risk analysis requirement rather than the attack itself.

How often does OCR announce enforcement actions?

Irregularly; 2025 averaged about two a month.

Where does this data come from?

The HHS Office for Civil Rights list of resolution agreements and civil money penalties, and the agreement documents linked from it.

Why are some amounts “not quantified”?

Some source pages have moved to an archive service, some are scanned images, and some announcements bundle several cases. We report an amount only when it appears in an HHS source we could read.

Is this legal advice?

No. It is a record of public enforcement data.

Methodology

References

1. HHS OCR, Resolution Agreements and Civil Money Penalties. Accessed October 2026.
2. HHS OCR, Anthem resolution agreement. Accessed October 2026.
3. HHS, The HIPAA Security Rule. Accessed October 2026.
4. Individual agreement documents, linked in the ledger above. Accessed October 2026.