卫生部民权办公室2025年度报告：HIPAA执法行动1,037项、和解与罚金逾8.68亿美元 均创纪录
华盛顿——卫生与公众服务部（Department of Health and Human Services, HHS）民权办公室（Office for Civil Rights, OCR）10月19日发布2025财政年度执法年度报告：全年共采取1,037项执法行动，达成的和解与民事罚金金额超过8.68亿美元，两项均为该办公室有记录以来的最高值。执法对象涵盖医院、医疗保险计划、诊所及处理受保护健康信息的第三方服务商等受《健康保险可携与责任法案》（HIPAA）约束的机构。
报告数据显示，1,037项行动较2024财年的604项增加约72%，和解与罚金总额较2024财年的5.25亿美元增加约65%；全年个案平均和解金额约118.4万美元。当年单笔金额最高的一笔为 UnitedHealth Group 就一次重大数据泄露达成的275万美元和解。Laboratory Corporation of America、PH&C LLC、Rudra LLC，以及医生 Dr. Richard Kim、Mark White 等机构与个人也被列入当年和解名单。
OCR 的执法依据包括 HIPAA 的隐私、安全与数据泄露通报规则。报告呼吁，掌握患者病历等受保护健康信息的机构应核对自身的数据安全与隐私合规安排；公众与机构如发现问题，可通过该办公室设立的自愿披露渠道 [email protected] 报告，涉及违规的机构可依「自愿自我披露协议」在60天内主动报告、纠正问题并与 OCR 达成和解。
HHS Civil Rights Office Reports Record HIPAA Enforcement in FY2025: 1,037 Actions, Over $868 Million
Washington — The Office for Civil Rights (OCR) at the Department of Health and Human Services (HHS) released its fiscal year 2025 enforcement annual report on October 19: the office took 1,037 enforcement actions during the year and collected more than $868 million in settlements and civil penalties, both record highs. Those subject to enforcement included hospitals, health plans, clinics and third-party vendors handling protected health information under the Health Insurance Portability and Accountability Act (HIPAA).
According to the report, the 1,037 actions rose about 72 percent from 604 in fiscal 2024, and total settlements and penalties rose about 65 percent from $525 million; the average settlement per matter was about $1.184 million. The largest single resolution of the year was a $2.75 million settlement with UnitedHealth Group over a major data breach. Laboratory Corporation of America, PH&C LLC, Rudra LLC, and physicians Dr. Richard Kim and Mark White were also named among the year's resolutions.
OCR enforces HIPAA's privacy, security and breach-notification rules. The report urged organizations holding protected health information such as patient records to review their data-security and privacy compliance; concerns can be reported through the office's voluntary disclosure channel at [email protected], and organizations that identify violations may, under the voluntary self-disclosure protocol, report and correct the problem within 60 days and reach a resolution with OCR.
发布：GSM·美国（发布链接）
图片来源：图：位于华盛顿的卫生与公众服务部总部汉弗莱大楼入口（2026年10月12日摄）。G. Edward Johnson 摄，CC BY 4.0，经 Wikimedia Commons 发布。
GSM Global · 本篇英文版 English edition of this story
