Cybersecurity Policy Report, Addiction Treatment Center Settles With HHS for Alleged HIPAA Security Rule Violation, (Feb 20, 2026)

By Tony Foley

Top of the World Ranch Treatment Center (TWRTC), an Illinois-based addition recovery facility, has reached a settlement with the HHS Office for Civil Rights (OCR) concerning a potential violation of the HIPAA (Health Insurance Portability and Accountability Act) Security Rule.

In a press release yesterday announcing the settlement, OCR explained that the HIPAA Security Rule requires administrative, physical, and technical safeguards to ensure the confidentiality, integrity, availability, and security of electronic protected health information (ePHI). In addition, the rule requires covered entities and business associates to conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI held by those organizations.

The settlement resolves an investigation OCR initiated after receiving a breach report from TWRTC in March 2023 in which it confirmed that, as a result of a phishing attack, an unauthorized third party accessed ePHI through an employee’s e-mail account. As a result, the ePHI of almost 2,000 patients was compromised. OCR’s investigation concluded that TWRTC failed to conduct a risk assessment as required under the Security Rule.

Under the terms of the resolution agreement agreed to by the parties, TWRTC has agreed to pay $103,000 to HHS. In addition, the facility will implement a corrective action plan that OCR will monitor for two years. The plan commits TWRTC to take steps to comply with HIPAA Rules and protect the security of ePHI, including the following remedial actions:

Conduct and complete an accurate and thorough risk analysis to determine the potential risks and vulnerabilities to the confidentiality, integrity, and availability of its ePHI;

Develop and implement a risk management plan to address and mitigate security risks and vulnerabilities identified in its risk analysis;

Develop, maintain, and revise, as necessary, written policies and procedures to comply with the HIPAA Privacy, Security, and Breach Notification Rules; and

Provide annual training for workforce members who have access to ePHI on its written HIPAA policies and procedures.

“In a time where health care providers and other HIPAA regulated entities are facing unprecedented cybersecurity threats, compliance with the HIPAA Risk Analysis provision is more essential than ever,” said OCR Director Paula M. Stannard. “Covered entities and business associates cannot protect electronic protected health information if they haven’t identified potential risks and vulnerabilities to that health information.”

News: LitigationEnforcement FederalLegislation DataSecurity DataBreach