By Mike Reeves | ComplianceJournal.news
The HHS Office for Civil Rights announced a settlement with MMG Fusion, LLC, a Maryland-based dental software company, over a 2020 data breach that exposed the protected health information of approximately 15 million individuals. The breach — which involved an unauthorized actor accessing MMG's systems and posting patient data to the dark web — resulted in the disclosure of names, phone numbers, mailing addresses, email addresses, dates of birth, and appointment information.
OCR's investigation found that MMG failed to conduct an accurate and thorough risk analysis before the breach occurred, the foundational HIPAA Security Rule requirement that organizations identify potential risks to electronic PHI before they become incidents. That failure — not the breach itself — is what made the settlement inevitable. OCR has made the risk analysis requirement the centerpiece of its enforcement program, and this case follows a consistent pattern: breaches that OCR investigates reveal pre-existing risk analysis deficiencies, which generate the settlement obligation.
For business associates — vendors that receive PHI from covered entities — this case is a direct warning. HIPAA's Security Rule applies to business associates with full force. A vendor whose software touches patient data cannot treat security compliance as the covered entity's problem. The risk analysis obligation runs to the business associate independently, and OCR will pursue it.
Source: U.S. Department of Health and Human Services — Read the full announcement →