--- title: HIPAA Settlement Highlights Cybersecurity Gaps in Self-Funded Health Plan description: A recent OCR settlement highlights the need for employer health plans to regularly assess risks and strengthen safeguards to secure electronic protected health information. image: https://blog.nisbenefits.com/hubfs/blog-headers/hipaa-cyber-b.jpg --- ![red warning triangle over computer keyboard](https://blog.nisbenefits.com/hubfs/blog-headers/hipaa-cyber-b.jpg) # HIPAA Settlement Highlights Cybersecurity Gaps in Self-Funded Health Plan - Home - [Employee Benefit News for School, City and County Employers](https://blog.nisbenefits.com) - HIPAA Settlement Highlights Cybersecurity Gaps in Self-Funded Health Plan [ Mari Wagner ](https://blog.nisbenefits.com/author/mari-wagner) 06/04/2026 [ Health Insurance Solutions](https://blog.nisbenefits.com/topic/health-insurance-solutions), [ Legislative News](https://blog.nisbenefits.com/topic/aca-other-legislative-news) [0 Comments ](https://blog.nisbenefits.com/hipaa-settlement-cybersecurity-gaps-self-funded-health-plan#postComment) 1 Minutes On April 23, 2026, U.S. Department of Health and Human Services’ Office for Civil Rights (OCR) [announced](https://www.hhs.gov/press-room/ocr-settles-four-ransomware-investigations.html) four HIPAA Security Rule ransomware settlements, including one involving a self-funded group health plan. This underscores the need for employer-sponsored health plans, especially those that create, receive, or maintain electronic protected health information (ePHI), to perform regular risk analyses and implement strong safeguards to protect it.   ## **Background** OCR enforces the [HIPAA Security Rule](https://www.hhs.gov/hipaa/for-professionals/security/index.html), requiring health plans and their business associates to safeguard ePHI. A thorough risk analysis is a core requirement; it identifies vulnerabilities and guides the safeguards you need to protect your organization’s electronic health information.   ## **HIPAA Settlement** Star Group, L.P.’s self-funded health plan suffered an October 2021 ransomware attack affecting 9,316 individuals, exposing names, addresses, dates of birth, Social Security numbers, and health insurance details. OCR found the plan had impermissibly disclosed ePHI and failed to conduct a proper risk analysis, resulting in a $245,000 settlement and a required corrective action plan.   ## **Key Compliance Steps** OCR encourages covered entities to take practical, proactive steps to strengthen security and reduce cyber risk, including: - Identify where ePHI lives in your systems and how it enters, moves through, and exits your organization; - Regularly complete and update a risk analysis, and put a risk management plan in place to address threats to your ePHI; - Put strong audit controls in place and routinely review system activity for unusual or unauthorized access; - Schedule routine reviews of system activity to catch issues early; - Use strong authentication tools so only authorized users can access ePHI; - Encrypt ePHI in transit and at rest to help prevent unauthorized access; - Incorporate lessons learned from incidents into your ongoing security program; and - Offer ongoing, role-specific HIPAA training tailored to your organization.   Download the [bulletin](https://blog.nisbenefits.com/hubfs/blog-supporting-docs/bulletin-hipaa-settlement-sf-plan-cybersecurity.pdf) for more details. [![Health Insurance RX Guide](https://no-cache.hubspot.com/cta/default/3325505/acb365d8-e250-4b5a-b7a1-bfac30f9a2f1.png)](https://cta-redirect.hubspot.com/cta/redirect/3325505/acb365d8-e250-4b5a-b7a1-bfac30f9a2f1) --- #### Tag: [ Health Insurance Solutions](https://blog.nisbenefits.com/topic/health-insurance-solutions) [ Legislative News](https://blog.nisbenefits.com/topic/aca-other-legislative-news) #### Share: - [Follow us on Facebook ](http://www.facebook.com/share.php?u=https://blog.nisbenefits.com/hipaa-settlement-cybersecurity-gaps-self-funded-health-plan) - [Follow us on Twitter ](https://twitter.com/intent/tweet?url=https://blog.nisbenefits.com/hipaa-settlement-cybersecurity-gaps-self-funded-health-plan&text=HIPAA%20Settlement%20Highlights%20Cybersecurity%20Gaps%20in%20Self-Funded%20Health%20Plan) - [Follow us on Linkedin ](http://www.linkedin.com/shareArticle?mini=true&url=https://blog.nisbenefits.com/hipaa-settlement-cybersecurity-gaps-self-funded-health-plan) - [Follow us on Pinterest ](http://pinterest.com/pin/create/button/?url=https://blog.nisbenefits.com/hipaa-settlement-cybersecurity-gaps-self-funded-health-plan&text=HIPAA%20Settlement%20Highlights%20Cybersecurity%20Gaps%20in%20Self-Funded%20Health%20Plandescription=On%20April%2023,%202026,%20U.S.%20Department%20of%20Health%20and%20Human%20Services’%20Office%20for%20Civil%20Rights%20(OCR)%20announced%20four%20HIPAA%20Security%20Rule%20ransomware%20settlements,[...]&media=https://3325505.fs1.hubspotusercontent-na1.net/hubfs/3325505/blog-headers/hipaa-cyber-b.jpg) --- [ #### Civil Penalties Hold Steady in 2026 ##### Previous Post ](https://blog.nisbenefits.com/civil-penalties-hold-steady-in-2026) [#### Smart Financial Ways to Care for Aging Pets ##### Next Post ](https://blog.nisbenefits.com/smart-financial-ways-care-for-aging-pets) ### Leave a Reply This is a search field with an auto-suggest feature attached. - There are no suggestions because the search field is empty. ### Category - [Legislative News (1149)](https://blog.nisbenefits.com/topic/aca-other-legislative-news) - [Health Insurance Solutions (504)](https://blog.nisbenefits.com/topic/health-insurance-solutions) - [COVID-19 (209)](https://blog.nisbenefits.com/topic/covid-19) - [Ancillary Benefits (175)](https://blog.nisbenefits.com/topic/ancillary-benefits) - [Mental Health (122)](https://blog.nisbenefits.com/topic/mental-health) ### Popular Posts [ Steve Smith ](https://blog.nisbenefits.com/author/steve-smith) 02/16/2024 [ Health Insurance Solutions](https://blog.nisbenefits.com/topic/health-insurance-solutions) [ Understanding Embedded vs. Nonembedded Deductibles ](https://blog.nisbenefits.com/understanding-embedded-nonembedded-deductibles) [ Erin Woulfe ](https://blog.nisbenefits.com/author/erin-woulfe) 02/09/2026 [ Health Insurance Solutions](https://blog.nisbenefits.com/topic/health-insurance-solutions), [ Legislative News](https://blog.nisbenefits.com/topic/aca-other-legislative-news) [ IRS Releases 2027 Health Plan Cost-sharing Limits ](https://blog.nisbenefits.com/2027-health-plan-cost-sharing-limits) [ Valerie Ortiz ](https://blog.nisbenefits.com/author/valerie-ortiz) 02/17/2026 [ Health Insurance Solutions](https://blog.nisbenefits.com/topic/health-insurance-solutions), [ The Administrator's Corner](https://blog.nisbenefits.com/topic/the-administrators-corner) [ 4 Employee Wellness Trends You Can’t Ignore in 2026 ](https://blog.nisbenefits.com/2026-employee-wellness-trends) [ Dina Lubben ](https://blog.nisbenefits.com/author/dina-lubben) 11/14/2025 [ Health Insurance Solutions](https://blog.nisbenefits.com/topic/health-insurance-solutions), [ Legislative News](https://blog.nisbenefits.com/topic/aca-other-legislative-news) [ Trump Administration Unveils Plan to Make GLP-1 Drugs Affordable ](https://blog.nisbenefits.com/trump-administration-plan-glp1-drugs-affordable) --- ## Related Posts [ Health Insurance Solutions](https://blog.nisbenefits.com/topic/health-insurance-solutions), [ Legislative News](https://blog.nisbenefits.com/topic/aca-other-legislative-news), [ The Administrator's Corner](https://blog.nisbenefits.com/topic/the-administrators-corner) [ Valerie Ortiz ](https://blog.nisbenefits.com/author/valerie-ortiz) 07 July, 2026 #### [New CMS Report: Healthcare Spending Trends Through 2034](https://blog.nisbenefits.com/healthcare-spending-trends-through-2034) New projections from the U.S. Centers for Medicare and Medicaid Services (CMS) Office of the… [Read More](https://blog.nisbenefits.com/healthcare-spending-trends-through-2034) [ Legislative News](https://blog.nisbenefits.com/topic/aca-other-legislative-news), [ The Administrator's Corner](https://blog.nisbenefits.com/topic/the-administrators-corner), [ Mental Health](https://blog.nisbenefits.com/topic/mental-health) [ Steve Smith ](https://blog.nisbenefits.com/author/steve-smith) 06 July, 2026 #### [New HHS Rule Expands Catastrophic Coverage Access](https://blog.nisbenefits.com/new-hhs-rule-expands-catastrophic-coverage-access) The U.S. Department of Health and Human Services’ (HHS) Notice of Benefit and Payment Parameters… [Read More](https://blog.nisbenefits.com/new-hhs-rule-expands-catastrophic-coverage-access) [ Health Insurance Solutions](https://blog.nisbenefits.com/topic/health-insurance-solutions), [ Legislative News](https://blog.nisbenefits.com/topic/aca-other-legislative-news) [ Mari Wagner ](https://blog.nisbenefits.com/author/mari-wagner) 25 June, 2026 #### [Federal Court Blocks Key ACA Exchange Restrictions](https://blog.nisbenefits.com/federal-court-blocks-key-aca-exchange-restrictions) A recent federal court ruling blocked stricter ACA Marketplace eligibility and enrollment… [Read More](https://blog.nisbenefits.com/federal-court-blocks-key-aca-exchange-restrictions)