Over the course of 2016, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) reached many resolution agreements with a number of covered entities and business associates for violation of the Health Insurance Portability and Accountability Act (HIPAA).

These HIPAA settlements are mutually agreed-upon resolutions between HHS and the offending entities. A settlement may require these parties to implement additional parameters to better secure personal health information (PHI). It may also include a civil money penalty and subject an offending entity to HHS monitoring for up to three years.