HIPAA Enforcement Continues to Be Hot in 2025

Yesterday, the Department of Health and Human Services’ Office for Civil Rights (OCR) announced its sixth HIPAA enforcement action of the year.  Just two months into 2025 and the total amount of settlements and penalties is already over $5 million.

Warby Parker, Inc., a manufacturer and e-retailer of prescription and non-prescription eyewear, was assessed a $1.5 million civil monetary penalty for a 2018 credential stuffing attack on customer accounts impacting about 200,000 individuals.  It then suffered four additional credential stuffing attacks between 2019 and 2022.

Five cyber attacks of the same variety over a five-year period certainly indicate a lack of adequate security measures.  OCR’s investigation revealed a failure to conduct an adequate security risk analysis, to implement security measures timely and to monitor system activity.  Fueling the large CMP here was the fact that, as of September 2024, Warby Parker still had not performed an adequate security risk analysis and it did not implement security measures to address the on-going security issues until after the five attacks.

The 2025 HIPAA enforcement year is on pace to eclipse the total amounts in previous years well before the half year mark.  The total thus far is $5,077,750.  Here’s a summary of the last six years: