Illinois-headquartered healthcare system settles potential HIPAA violations after data breach

Aug. 17, 2026

2 min read

Key Highlights

OSF Healthcare experienced a ransomware attack that compromised the PHI of nearly 54,000 patients, prompting an OCR investigation.
The investigation revealed potential violations including failure to perform a thorough risk analysis and delayed breach notifications to affected individuals and HHS.
OSF paid a settlement of $552,250 and committed to a corrective action plan to address HIPAA compliance issues and improve data security measures.

6a8329a3435ad15915f6124d Dreamstime Xxl 347620322

An Illinois-headquartered healthcare system has settled with the U.S. Department of Health and Human Services (HHS), Oﬃce for Civil Rights (OCR) over potential HIPAA violations resulting in the compromising of nearly 54,000 patients’ protected health information (PHI).

The health system, OSF Healthcare System and its Affiliated Covered Entities (OSF), filed a breach report with OCR in October 2021. This resulted in an OCR investigation. Six months prior to the report, OSF discovered a ransomware attack against its files via the “Nephilim” variant of ransomware.

According to HHS, the actor accessed:

Driver’s license numbers
Diagnosis and treatment information
Prescription information
Medical record numbers
Provider names
Dates of services
Financial account information
Health insurance information

Upon investigating OSF, OCR reported the following potential HIPAA violations:

Failing to conduct an accurate and thorough risk analysis of the potential risks and vulnerabilities to the ePHI held by OSF
Impermissibly disclosing the PHI of 53,907 individuals
Failing to provide timely breach notification to affected individuals
Failing to provide timely breach notification to the Secretary of HHS

OSF has paid $552,250 to OCR and will undergo a corrective action plan to resolve this.