Medcurity Compliance Digest — Week of June 29, 2026
Welcome to this week’s Medcurity Compliance Digest, where we track OCR enforcement, new breach reports, and regulatory signals — and translate them into what your practice should actually do this week.
OCR Enforcement Actions This Week
No new OCR enforcement actions were announced this week (June 26 – July 3). A quiet week on the enforcement front — but the most recent action is worth keeping in view, because it extends the pattern OCR has been building all year.
On June 18, OCR announced its settlement with Spencer Gifts LLC’s employee health plan: $450,000 plus a corrective action plan, following a November 2021 ransomware attack that encrypted servers holding plan members’ ePHI. This was OCR’s 20th ransomware enforcement action and the 14th under its Risk Analysis Initiative. The core finding was familiar: the plan had never conducted an accurate and thorough risk analysis (45 CFR §164.308(a)(1)(ii)(A)) before the breach. The corrective action plan requires a comprehensive risk analysis, updated policies and procedures, and workforce HIPAA training.
Why a quiet week still matters: OCR’s Risk Analysis Initiative is now 14 actions deep, and every one of them cites the same failure — no accurate, thorough, documented risk analysis. When enforcement resumes (and the 2026 cadence suggests it will, quickly), the question OCR asks first hasn’t changed. If your organization sponsors a self-insured health plan — even if you’re not a healthcare provider — the Spencer Gifts action confirms the plan itself is a covered entity and OCR will enforce against it.
New Breach Portal Additions
⚠️ The HHS “Wall of Shame” publishes breaches by submission date and typically lags public visibility by several weeks. As of this writing, the most recent entries visible on the portal carry submission dates of May 1, 2026 — no entries with submission dates in the past 7 days are yet visible. Rather than fabricate a weekly count, here’s what the newest visible cohort (late April – May 1 submissions) shows:
- Western Orthopaedics, P.C. (CO) — Hacking/IT incident, network server, 113,330 individuals
- Mt. Spokane Pediatrics (WA) — Hacking/IT incident, network server, 32,021 individuals
- Tri-Cities Gastroenterology (TN) — Hacking/IT incident, network server, 67,115 individuals
- Florida Physician Specialists (FL) — Hacking/IT incident, network server, 276,498 individuals
- University of Michigan / Michigan Medicine (MI) — Unauthorized access/disclosure, EMR, 551 individuals
- Plus a steady run of specialty and small practices (pain management, dental, prosthetics, plastic surgery) in the 500–7,500 range, mostly hacking incidents against network servers and email accounts.
The pattern holds: hacking/IT incidents against network servers remain the overwhelming breach type, and the victims skew heavily toward independent specialty practices and small provider groups — exactly the organizations least likely to have network segmentation, MFA everywhere, and a current risk analysis. Industry tracking puts H1 2026 at roughly 189 large breaches affecting 19+ million individuals, with over 90% attributed to hacking/IT incidents. ⚠️ (H1 figures are third-party tallies of portal data, not an HHS publication — treat as directional.)
Most at-risk profile this week: small specialty practices (ortho, GI, pain, dental) running their own network servers. One-line action: confirm your EHR and file servers are not directly internet-exposed, and that remote access requires MFA — this single check addresses the most common breach vector on the portal right now.
Regulatory & Enforcement Signals
- TEFCA milestone (June 26): HHS announced the TEFCA network has exchanged over one billion health records and is expanding secure access to health records. As interoperability scales, so does the surface area of PHI moving between organizations — expect OCR and ONC attention to how provider organizations authenticate and log access through network intermediaries.
- Security Rule finalization watch: The December 2024 NPRM (mandatory encryption, universal MFA, network segmentation, semiannual vulnerability scans, annual pen testing, removal of “addressable” specifications) remains unfinalized. OCR’s regulatory agenda had targeted spring 2026; that window has passed with no final rule published, and industry coalitions representing 100+ hospital systems have pressed for withdrawal or major revision. ⚠️ No confirmed finalization date exists — any vendor telling you the final rule’s compliance deadlines are set is ahead of the facts. Nothing new was published this week.
- No new OCR guidance documents or FAQs were published this week. The most recent Security Rule guidance refresh was June 4.
What This Means for Your Practice
If you’re a small practice: Use the quiet enforcement week to do the thing OCR keeps fining organizations for skipping — a documented risk analysis. Fourteen of fourteen Risk Analysis Initiative actions cite its absence. If yours is older than 12 months or doesn’t reflect your current systems, that’s this week’s project.
If you’re an FQHC, CHC, or rural hospital: The breach portal cohort shows mid-sized community providers (a 570,000-record FQHC breach at Erie Family Health Centers is still under investigation) squarely in attackers’ sights. Verify your business associate inventory is current — vendor and BA-chain compromises are driving the largest incident counts, and OCR will ask for your BAAs first.
If you’re a mental health or behavioral health provider: Behavioral health entities keep appearing on the portal (North Texas Behavioral Health Authority, 285,000+ individuals; New Horizons Behavioral Health; VNS Health). Your records carry heightened sensitivity and, where 42 CFR Part 2 applies, a second reporting regime — confirm your breach response plan addresses both HIPAA and Part 2 notification.
If you’re a multi-site provider group: Specialty groups and management companies (ASC management, dermatology platforms like QualDerm at 3.1M records) are the biggest-number breaches of 2026. Centralized IT means centralized blast radius: segment networks between sites and ensure your risk analysis covers every location and acquired entity, not just headquarters.
If you sponsor a self-insured health plan: Spencer Gifts is the warning shot — OCR enforces against employer health plans, not just providers. Your plan needs its own risk analysis and safeguards, separate from corporate IT’s general security program.
The Medcurity Perspective
This week’s evidence points the same direction it has all year: OCR’s enforcement engine runs on one question — can you produce an accurate, thorough, current risk analysis? — and the breach portal keeps filling with small and mid-sized providers who couldn’t. A risk register that maps directly to OCR’s Security Rule citations, kept current and paired with documented workforce training, is the difference between a corrective action plan and a closed inquiry. That’s the work Medcurity exists to make manageable for healthcare organizations of every size.
Get ahead of the next digest
The pattern in this week’s digest is the same one OCR has been writing all year: when enforcement lands, the first document requested is the risk analysis. If yours is more than 12 months old — or you couldn’t produce it on request — explore Medcurity’s HIPAA compliance solutions for risk assessments, BAA tracking, and the risk-management documentation OCR keeps citing.
Frequently Asked Questions
Were there any new OCR HIPAA enforcement actions the week of June 29, 2026?
No new OCR resolution agreements, settlements, or civil monetary penalties were announced between June 26 and July 3, 2026. The most recent action remains OCR’s June 18 settlement with Spencer Gifts LLC’s employee health plan — $450,000 plus a corrective action plan following a November 2021 ransomware attack. That was OCR’s 20th ransomware enforcement action and the 14th under its Risk Analysis Initiative, and like the others it turned on whether the organization could produce an accurate, thorough HIPAA risk analysis.
Has the updated HIPAA Security Rule been finalized?
No. The December 2024 Notice of Proposed Rulemaking — which would mandate encryption, universal multi-factor authentication, network segmentation, semiannual vulnerability scans, annual penetration testing, and removal of the “addressable” designation — remains unfinalized as of July 2026. OCR is already enforcing its central theme through the Risk Analysis Initiative, so practices should prepare as though the proposed requirements are coming rather than waiting for a final rule.
What were the largest breach portal entries noted this week?
The HHS breach portal publishes by submission date and typically lags public visibility by several weeks; as of this writing the most recent visible entries carry submission dates of May 1, 2026. Among the notable recent additions: Florida Physician Specialists (276,498 individuals), Western Orthopaedics (113,330), Tri-Cities Gastroenterology (67,115), and Mt. Spokane Pediatrics (32,021) — all hacking/IT incidents involving network servers. The largest 2026 breaches continue to come from multi-site platforms and vendors, such as the QualDerm incident affecting roughly 3.1 million records.
Does OCR enforce HIPAA against employer health plans?
Yes. The Spencer Gifts settlement is the clearest recent example: OCR enforced against a self-insured employee health plan, not a healthcare provider. If you sponsor a self-insured plan, the plan itself is a HIPAA-covered entity that needs its own risk analysis, safeguards, and documentation — separate from your corporate IT department’s general security program.
Sources: HHS Press Room · OCR Spencer Gifts settlement · HHS Breach Portal · TEFCA announcement · Security Rule NPRM fact sheet