HHS reaches $350K settlement with Northeast Radiology over security failures

Written by Tshedimoso Makhene | Apr 15, 2025 10:14:31 PM

The U.S. Department of Health and Human Services has reached a $350,000 settlement with Northeast Radiology over HIPAA Security Rule violations following a breach that exposed the electronically protected health information of nearly 300,000 patients.

What happened

On the 10th of April, 2025, the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR) announced a settlement with Northeast Radiology, P.C. (NERAD) following a breach involving the protected health information of nearly 300,000 individuals. The settlement stems from violations of the Health Insurance Portability and Accountability Act’s (HIPAA) Security Rule, which is linked to a security lapse on NERAD’s Picture Archiving and Communication System (PACS), a server used to store and access radiology images.

According to a breach report submitted by NERAD in March 2020, unauthorized individuals accessed unsecured electronic protected health information (ePHI) between April 2019 and January 2020. The OCR investigation concluded that NERAD had not conducted a proper risk analysis, a key requirement under the HIPAA Security Rule designed to safeguard ePHI.

See also:

Understanding and implementing HIPAA rules
HIPAA Compliant Email: The Definitive Guide (2025 Update)

Going deeper

As part of the resolution agreement, NERAD will pay $350,000 and adopt a comprehensive corrective action plan that will be monitored by the OCR for the next two years. This includes:

Performing a thorough risk analysis of its information systems;
Implementing a risk management strategy to address identified security vulnerabilities;
Regularly auditing system activity and security incident reports;
Updating its HIPAA policies and procedures;
Enhancing its HIPAA training programs for staff.

In other news: The proposed removal of limits on HIPAA fines

What was said

OCR Acting Director Anthony Archeval emphasized the need for risk analysis in maintaining HIPAA compliance: “A HIPAA risk analysis is essential to identifying where electronic protected health information is stored, and the security measures in place to protect it. A failure to conduct a risk analysis often foreshadows a future HIPAA breach.”

The resolution agreement further outlines the obligations and terms Northeast Radiology, P.C. (NERAD) has committed to under the settlement:

Payment terms: NERAD agreed to pay the U.S. Department of Health and Human Services (HHS) $350,000 as a resolution amount. The payment is to be made in a single lump sum on the agreement’s effective date via an automated clearing house transaction.
Corrective Action Plan (CAP): NERAD has also agreed to a two-year corrective action plan, detailed in Appendix A of the agreement. The plan outlines the steps NERAD must take to strengthen HIPAA compliance. Failure to meet the terms of the CAP may result in NERAD breaching the agreement and forfeiting certain protections, including HHS’s conditional release of further action.
Conditional release: HHS has agreed to release NERAD from civil monetary penalties and other actions related to the identified violations, provided NERAD complies fully with the agreement. This release does not extend to violations under Section 1177 of the Social Security Act, which covers knowingly obtaining or disclosing individually identifiable health information.
No contest or appeal: NERAD has waived its right to contest the resolution amount or any associated obligations, including waiving rights to notice, hearing, or appeal typically provided under the Social Security Act and HIPAA enforcement regulations.
Binding agreement: The resolution binds NERAD, its successors, heirs, and assigns. Both parties have also agreed that they will each bear their own legal costs related to the case.
Public disclosure: HHS noted that the resolution agreement is not confidential and may be published or released in accordance with the Freedom of Information Act.

Finally, the agreement includes a provision tolling the statute of limitations to ensure that potential civil monetary penalties related to the covered conduct can still be pursued if NERAD breaches the agreement during the monitoring period.

In the know

The HIPAA Security Rule mandates that covered entities and their business associates implement administrative, physical, and technical safeguards to protect ePHI. One of the core requirements—the “Risk Analysis” provision—requires organizations to assess risks and vulnerabilities to ePHI across their systems. OCR’s investigation revealed that NERAD failed to carry out this essential analysis, leaving the PACS server vulnerable to unauthorized access.

This enforcement marks the sixth action in OCR’s ongoing Risk Analysis Initiative, which aims to ensure compliance with foundational cybersecurity requirements in health care.

Why it matters

The enforcement action against Northeast Radiology sends a clear message to all HIPAA covered entities and business associates: noncompliance with the Security Rule, particularly the Risk Analysis provision, can have serious financial and reputational consequences. It also stresses OCR’s ongoing commitment to strengthening cybersecurity in healthcare and protecting patient privacy in an evolving digital landscape.

FAQS

What happens if a healthcare provider doesn’t comply with HIPAA?

Failure to comply with HIPAA can lead to civil monetary penalties, corrective action plans, reputational damage, and in some cases, criminal charges. The Office for Civil Rights (OCR) enforces HIPAA and investigates reported violations and breaches.

Who is covered under HIPAA regulations?

HIPAA applies to covered entities, including health plans, healthcare clearinghouses, and most healthcare providers, as well as their business associates who handle protected health information on their behalf.

What is a Corrective Action Plan (CAP)?

A Corrective Action Plan is a set of steps that an organization agrees to implement to address HIPAA compliance deficiencies identified during an OCR investigation. CAPs often include measures like updated policies, staff training, and regular audits.

View full post