For healthcare organizations, containing a cyber incident and notifying affected individuals may end the immediate breach response, but it rarely ends the exposure. Regulatory investigations and class action litigation can continue for months or years, potentially producing multi-million-dollar settlements long after systems have been restored.
The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) enforces the HIPAA Privacy and Security Rules, and recent enforcement activity offers an important signal for healthcare organizations and their insurers. In 2025, OCR resolved 21 settlements and civil monetary penalties, collecting $8.3 million. An incomplete or missing risk analysis remained the deficiency cited most often. Since October 2024, actions brought under OCR’s Risk Analysis Initiative have repeatedly cited the HIPAA Security Rule requirement that covered entities and business associates conduct, an accurate and thorough assessment of potential risks, and vulnerabilities to electronic protected health information.
That focus matters to claims professionals because post-breach scrutiny often looks backward. Regulators may examine not only how an organization responded after discovering an incident, but also whether it adequately identified, documented, and managed cybersecurity risks before the breach occurred.
State enforcement can add another layer of exposure. In one 2023 matter arising from a 2020 ransomware attack, an organization reached a settlement with 49 state attorneys general and the District of Columbia over alleged violations involving consumer protection, breach notification, and HIPAA requirements, along with significant corrective-action obligations. In another matter, healthcare clearinghouse Inmediata paid $1.4 million to a coalition of state attorneys general after a coding error exposed protected health information for approximately 1.56 million individuals to search engines for nearly three years. OCR separately resolved that matter for $250,000.
The distinction is important for risk modeling: a healthcare breach can create overlapping federal and state regulatory exposure, and the financial consequences may extend well beyond a single HIPAA enforcement action. State regulators continue to use their authority in cyber matters. In December 2025, the New York Attorney General announced a $500,000 settlement with OrthopedicsNY following an investigation into a breach affecting approximately 656,000 individuals.
The 2024 ransomware attack on Change Healthcare demonstrates how quickly exposures can escalate when a critical health care intermediary is compromised. The disruption spread across health care and billing systems nationwide, prompting HHS investigations into potential HIPAA violations. An American Hospital Association survey found that 94% of responding hospitals experienced a financial impact and 74% reported an impact on patient care. For claims professionals, the incident underscores how a third-party ransomware event can rapidly compound into business interruption, regulatory scrutiny, third-party claims, litigation and aggregation risk across organizations sharing the same technology infrastructure.
Incidents of this scale are also occurring against a backdrop of heightened regulatory expectations. OCR has proposed the first substantive overhaul of the HIPAA Security Rule since 2013. OCR has proposed the first substantive overhaul of the HIPAA Security Rule since 2013. The proposal would strengthen requirements involving risk analysis, asset inventories and network mapping, multifactor authentication, encryption, and other cybersecurity safeguards. The proposal has not been finalized, so the existing Security Rule remains controlling. But the direction is clear: Regulators increasingly expect cybersecurity risks to be documented, actively managed, and regularly reassessed.
Regulatory action is only one source of post-breach exposure. Healthcare organizations may also face state and federal class actions alleging negligence, breach of contract, fraud, statutory privacy violations, and other claims. The California Consumer Privacy Act and Illinois Biometric Information Privacy Act are among the laws plaintiffs’ counsel have invoked in privacy litigation. Website tracking technologies, including Meta Pixel and session-replay tools, have created an additional source of litigation involving the alleged gathering and disclosure of protected health information and other sensitive data.
Class actions can develop quickly. A Connecticut organization agreed to an $18 million settlement resolving a consolidated class action that combined 18 complaints only months after its March 2025 breach. Litigation arising from other major healthcare cyber incidents has included consolidated class actions, motions to dismiss, and congressional scrutiny. These matters illustrate how an incident that begins as an operational and forensic response can evolve rapidly into a complex, multi-front claim.
For claims professionals, that expanding tail of liability means breach-response decisions should not be viewed in isolation. Early choices involving forensic investigation, notification, documentation, and communications may later be examined by regulators and plaintiffs’ counsel. Carriers, insureds, breach counsel, and forensic specialists should therefore consider potential regulatory and class action consequences from the beginning of the response rather than treating them as separate issues that arise only after notification is complete.
That approach also places greater importance on coordination. Regulatory inquiries and civil litigation may proceed on different timelines and under different legal standards, yet both can draw on the same investigation records, risk assessments, communications, and breach-response decisions. Preserving evidence, maintaining clear documentation, and aligning the response team early can help organizations avoid unnecessary inconsistencies and make later defense efforts more efficient.
The financial picture can continue evolving as well. Regulatory settlements, class-action defense costs, potential indemnity, forensic expenses, notification costs, and business interruption can arise on different schedules. For insurers and risk managers, the practical implication is that early reserving and exposure assessments may need to account for a longer liability tail than the initial incident suggests. The existence of multiple proceedings also reinforces the value of clear responsibility for decision-making and consistent documentation across the response.
Cyber insurance should be considered in that broader context. Coverage terms, limits, retentions, sub limits, exclusions, and notice requirements may affect how post-breach costs are allocated. Health care organizations and their advisers should review applicable policy language early and coordinate with insurers as regulatory investigations or civil claims develop. The goal is not simply to move quickly, but to make response decisions with an understanding that those decisions may later become evidence in a regulatory inquiry or lawsuit.
Healthcare organizations should approach a material cyber breach with the expectation that notification may open, rather than close, the next phase of the claim. Planning from the outset for regulatory scrutiny and potential litigation can help preserve evidence, coordinate defense strategy, and reduce the risk that decisions made during the urgency of breach response create additional exposure months or years later.
About the author
Kirsten Mickelson is the Cybersecurity Lead at Gallagher Bassett, where she focuses on cyber claims, complex coverage issues, and emerging cyber risk. kirsten_mickelson@gbtpa.com